The Smart Routing feature lets you plan traffic paths for your Smart Access Gateway (SAG) hardware instances. The system automatically probes the status of each path's egress interface. If an egress interface becomes unhealthy, traffic is automatically rerouted through another interface. This provides intelligent path selection.
Components
To use the Smart Routing feature, you associate a SAG instance with a routing policy. Each routing policy contains one or more rules. Each rule consists of three parts: a priority, match conditions, and an egress interface.
Component | Description |
Priority | Each rule has a priority. Traffic is matched against rules in order of priority, from highest to lowest. A smaller value indicates a higher priority. |
Match condition | Each rule contains one or more match conditions. Traffic must satisfy all match conditions within a rule for the rule to be matched. |
Egress interface | Each rule specifies one egress interface. The system automatically performs a health check on the egress interface. If traffic matches a rule and the interface status is healthy (status is UP), the matching process stops. The system then forwards the traffic through the specified egress interface. If traffic matches a rule but the egress interface is unhealthy (status is DOWN), the system evaluates the next rule. If traffic does not match any rule, the system determines the egress interface based on the route table. |
Matching process
A routing policy is applied after inbound access control rules and before outbound access control rules. If a SAG instance is associated with both an access control policy (which contains inbound and outbound rules) and a routing policy, the traffic is matched as follows:
For more information about how traffic is matched against inbound and outbound access control rules, see Access control overview.
Traffic is first evaluated against the inbound access control rules of the access control policy:
If traffic matches a permit rule, the system then evaluates it against the routing policy.
If traffic matches a deny rule, the system drops the traffic and the process ends.
If traffic does not match any inbound access control rule, the system proceeds to evaluate the traffic against the routing policy.
The system then evaluates the traffic against the rules in the routing policy one by one:
If traffic matches a rule and the rule's egress interface is healthy (status is UP), the routing policy evaluation ends. The system selects the rule's egress interface and then evaluates the outbound access control rules.
If traffic matches a rule but the egress interface is unhealthy (status is DOWN), the system evaluates the next rule.
If traffic matches the last rule but its egress interface is also unhealthy (status is DOWN), the system determines the egress interface based on the route table and then evaluates the outbound access control rules.
If traffic does not match any rule in the routing policy, the system determines the egress interface based on the route table and then evaluates the outbound access control rules.
After the egress interface is determined, the traffic is evaluated against the outbound access control rules:
If traffic matches a rule that permits access, the system forwards the traffic through the egress interface determined in the previous step.
If traffic matches a rule that denies access, the system drops the traffic.
If traffic does not match any outbound access control rule, the system forwards the traffic through the egress interface determined in the previous step.
Limitations
The Smart Routing feature is supported only on SCG 5000 and SCG 5000-5G devices.
An SAG instance can be associated with only one routing policy.
You can create a maximum of 15 rules within a single routing policy.
Step 1: Create a routing policy
To use Smart Routing, you must first create a routing policy.
Log on to the SAG console.
In the top navigation bar, select the region.
In the left-side navigation pane, choose Smart Routing Policies.
On the Smart Routing Policies page, click Create Policy.
In the Create Policy dialog box, set the following parameters, and then click OK.
Parameter
Description
Name
Enter a name for the routing policy.
Applicable device model
Select the device model to which the routing policy applies. The policy can be applied only to SCG 5000 and SCG 5000 (5G) devices.
Resource group
Select the resource group to which the routing policy belongs.
Description
Enter a description for the routing policy.
Step 2: Add rules
After you create a routing policy, add rules to it. The rules match traffic from your SAG device and direct it to a specified egress interface.
On the Smart Routing Policies page, find the routing policy that you created and click its ID.
On the details page of the routing policy, click the Rule tab, and then click Add Rule. On the Add Rule page, configure the basic information for the rule, and then click Next.
Parameter
Description
Rule Name
Enter a name for the rule.
Rule Description
Enter a description for the rule.
Priority
Select a priority for the rule.
The priority value ranges from 1 to 100. A smaller value indicates a higher priority. Each rule within a routing policy must have a unique priority.
Port Type
Select the egress interface type. Valid values:
Physical Port: Specifies a physical port on the SAG device as the egress interface.
Tunnel Port: Specifies a tunnel port on the SAG device as the egress interface.
Port
Select a physical port. Valid values:
LTE: The egress interface is the 4G or 5G cellular card of the SAG device.
WAN Port: The egress interface is the WAN port of the SAG device.
NoteThis parameter is required only when Port Type is set to Physical Port.
Health Check Object
Select the condition for the health check.
The only valid value is Interface Status. This setting causes the system to perform a health check on the selected egress interface and use the interface status to determine if the rule is active.
When the system detects the egress interface status is UP (healthy), the rule becomes active. Traffic that matches this rule is forwarded through the specified interface.
When the system detects the egress interface status is DOWN (abnormal), the rule is inactive. Even if traffic matches this rule, it is not forwarded through this interface. Instead, the system evaluates the next rule.
Click Add Match Condition. In the Add Match Condition dialog box, configure the match condition, and then click OK.
You can add only one match condition at a time. To add multiple match conditions, click Add Match Condition again. Multiple match conditions have a logical AND relationship, meaning traffic must meet all conditions to match the rule.
Parameter
Description
Match Item
Select the type of traffic characteristic to match. The system supports matching traffic based on the following fields:
Source CIDR block: Matches traffic whose source IP address is within the specified CIDR block. If not set, this condition matches traffic from any source address by default. Example format: 192.168.10.0/24 or 10.10.10.10/32.
The total number of source and destination CIDR blocks across all rules in a routing policy cannot exceed 10,000 by default.
Destination CIDR block: Matches traffic whose destination IP address is within the specified CIDR block. If not set, this condition matches traffic to any destination address by default. Example format: 172.16.10.0/24 or 10.0.0.1/32.
The total number of source and destination CIDR blocks across all rules in a routing policy cannot exceed 10,000 by default.
Source port range: Matches traffic whose source port is within the specified range. If not set, this condition matches traffic from any source port by default.
You can enter up to 7 source port ranges per rule. The valid range is from -1 or 1 to 65535.
1/200: represents source ports 1 to 200.
80/80: represents source port 80.
-1/-1: represents any source port.
The value -1/-1 must be used exclusively and cannot be combined with other port ranges.
Destination port range: Matches traffic whose destination port is within the specified range. If not set, this condition matches traffic to any destination port by default.
You can enter up to 7 destination port ranges per rule. The valid range is from -1 or 1 to 65535.
1/200: represents destination ports 1 to 200.
80/80: represents destination port 80.
-1/-1: represents any destination port.
The value -1/-1 must be used exclusively and cannot be combined with other port ranges.
Protocol type: Matches traffic based on the protocol type. If not set, this condition matches traffic of any protocol type by default.
The supported protocols include HTTP, HTTPS, UDP, TCP, and SSH. For a complete list, see the information in the console. You can select one protocol per rule.
Domain name list: Matches traffic based on the destination domain name. If not set, this condition matches traffic to any domain name by default.
You can enter up to 50 domain names per rule. Example:
www.example.comorexample.com.
ImportantAfter you configure a match condition for Destination CIDR Block or Protocol Type, you cannot configure a match condition for Domain Name List.
Enter Match Value
After you select a Match Item, enter the value to match.
Enter each value on a new line. Multiple values have a logical OR relationship, meaning traffic matches the condition if it matches any of the specified values.
If you have a large number of values for Source CIDR block, Destination CIDR block, or Protocol type, we recommend that you import them from a file.
Import Match Value
To import values from a file, click the
icon, select a local file that contains the values, and then click Open.The file must be a .txt file and its size must be 0.001 MB to 10 MB. Each value must be on a separate line in the file.
Click Next and then choose Add More, View Rule Details, or Back to Rules.
Step 3: Associate an SAG instance
After adding rules, associate the routing policy with a SAG instance. This action applies the policy to the SAG device bound to the instance.
On the Smart Routing Policies page, find the routing policy that you created and click its ID.
On the details page of the routing policy, click the Associated Instances tab, and then click Associated Instance.
On the Associate Instance page, set the following parameters, and then click OK.
Parameter
Description
Resource Group
Select the resource group to which the SAG instance that you want to associate belongs.
Smart Access Gateway
In the Instances, select one or more SAG instances, and then click the
icon to move them to the selected list.
More operations
Actions | Procedure |
Add a match condition |
|
Edit a match condition |
|
Delete a match condition |
|
Delete a rule |
|
Remove an SAG instance |
|
Delete a routing policy |
|
> Remove