Layer 4 Policies Lookup Mechanism

When AppDirector receives a packet where the Destination IP address is a Virtual IP address, AppDirector performs the following steps:

AppDirector searches its Client Table for a matching entry.

The match can be either a full Layer 4 match for a farm whose Sessions mode is different than Regular mode, or a match of Source IP, Destination VIP and Destination port. If a matching entry is found, the packet is forwarded according to the existing server selection. If no matching entry is found, AppDirector performs Step 2.

AppDirector searches its Layer 4 Policies to find an entry that matches the traffic

This is performed according to existing farm selection in the following order:

1.	First AppDirector searches for a full match between the Destination IP, Destination IP Protocol and Destination Port fields of the incoming packet parameters and Layer 4 Policy Virtual IP, Layer 4 Protocol, and Layer 4 Port parameters.

2.	If no match is found, AppDirector re-scans the Layer 4 Policies again, looking for a full match between the Destination IP address and Destination IP Protocol fields of the incoming packet, and Layer 4 Policy Virtual IP and Layer 4 Protocol parameters, which include TCP, UDP, ICMP, Any or Other.

3.	If no match is found, AppDirector re-scans the Layer 4 Policies looking for a match between the Destination IP address of the incoming packet and the Layer 4 Policy Virtual IP parameter.

4.	If there is no match, the packet is discarded.

5.	If the entry is matched, AppDirector performs an additional search in the Layer 4 Policies Table, checking whether the incoming packet’s Source IP address fits into the Layer 4 client IP address range.

6.	This search is applied only to entries that were matched in Step 2.

7.	The Layer 4 policy redirects the traffic to the proxy if SSL/Cache/Compression/Client Authentication policies are attached to it.

8.	The traffic from the Proxy is then redirected back to AppDirector to an internal Layer 4 policy and from there to a farm and server.

9.	After a policy is matched, a server is selected within the farm associated with the matched policy, and the packet is forwarded to that server.

10.	If the Layer 4 Policy is mapped to a Layer 7 policy, the Delayed Bind is activated. When AppDirector receives enough information from the HTTP Header, a farm can be selected according to that Layer 7 policy.

Note: The order of configured policies has no impact; the most specific policy is always matched, using the above logic.