Filter Policies
Router Configuration Guide 497
→ When all PBR destinations are down, action forward is programmed and the PBR
lookup is performed in the routing instance of the incoming interface where the
filter policy using the given redirect policy is deployed.
→ Any destination tests configured are always executed in the "Base" router
instance regardless of the router instance of the incoming interface where the
filter policy using the given redirect policy is deployed.
Caveats:
• Only unicast-rt-test and ping-test are supported when router option is enabled.
HTTP-redirect (Captive Portal)
Web redirection policies can be configured on SR OS routers/switches. The http redirection
action can block a customer’s request from an intended recipient and force the customer to
connect to the service’s portal server. 255 unique entries with http-redirect are allowed.
Traffic Flow
The following example provides a brief scenario of a customer connection with web
redirection.
1. The customer gets an IP address using DHCP (if the customer is trying to set a static
IP he will be blocked by the anti-spoofing filter).
2. The customer tries to connect to a website.
3. The router intercepts the HTTP GET request and blocks it from the network
4. The router then sends the customer an HTTP 302 (service temporarily unavailable/
moved). The target URL should then include the customer’s IP and MAC addresses
as part of the portal’s URL.
5. The customer’s web browser will then close the original connection and open a new
connection to the web portal.
6. The web portal updates the ACL (directly or through SSC) to remove the redirection
policy.
7. The customer connects to the original site.
To Next Page
Loading...
