Layer 4 Policies

A Layer 4 Policy lets you set a single point of entry, that is, a single Virtual IP address, for a variety of application services, allowing different groups of users to receive services according to their individual needs.

All the VIPs managed by AppDirector are defined under Layer 4 Policies. When AppDirector receives the first packet of a session destined to a Virtual IP address, it searches for a Layer 4 Policy that matches the Layer 4 Protocol, Destination port, Source IP address, and so on. Then, based on this information, AppDirector selects the farm allocated to this service and the best server for the task from that farm, and forwards the packet to that server.

AppDirector supports both IPv4 and IPv6 VIPs. Any type of VIP can be attached to farm or farms with either IPv4, IPv6 or mixed IPv4 and IPv6 servers.

When the IP version of the VIP is different than the IP version of a server attached to it (through a farm) AppDirector performs IP gateway functionality and translates IPv6 front-end session to an IPv4 back-end session or vice-versa.

Note: For FTP, there is no need to create a port 20 Layer 4 policy for the active FTP-data connections. AppDirector handles active and passive data connections to the same VIP as the FTP-control Layer 4 policy. FTP-data exists as an application if a direct active FTP-data connection to a port other than 20 occurs.

In addition to farm selection, the Layer 4 policy also defines application acceleration policies to be applied on traffic matching the Layer 4 policy, when required. Application acceleration policies include SSL offload configuration, compression and caching rules and HTTP multiplexing activation.

To set up or update a Layer 4 policy

1.	From the AppDirector menu, select Layer 4 Traffic Redirection > Layer 4 Policies. The Layer 4 Policies pane displays.

2.	Click Create, OR select the Layer 4 Policy Name if you want to update. The Layer 4 Policy Create pane displays

3.	Set the parameters.

 

Parameter	Description
Layer 4 Policy Name	A unique name identifying the Layer 4 Policy.
Policy Classifiers
Virtual IP Type (Read Only)	The Virtual IP type on which AppDirector intercepts distributed traffic using the triangulation method. Values: IPv4, IPv6
Virtual IP	The IP address through which clients access the application services that this Layer 4 policy processes. Notes:   When you enter a Virtual IP address in IPv4 format, the parameters Source IP From/To accept IPv4 type addresses. When you enter a Virtual IP address in IPv6 format, the parameters Source IP From/To accept IPv6 type addresses.
Layer 4 Protocol	Layer 4 protocol for which the policy provides services. Values include: TCP UDP ICMP SCTP Any — Any IP protocol, including TCP, UDP and ICMP Other — Any IP traffic that is not TCP, UDP or ICMP Default: TCP
Layer 4 Port	Destination Layer 4 port for the configured Layer 4 Protocol. Default: Any
Application	The Application parameter allows using custom TCP or UDP ports for applications that require special handling, such as HTTP, HTTPS, FTP, SIP, and so on. For example, use port 2100 for FTP Control Channel. For well-known protocols, such as 80 for HTTP, there is no need to specify the application. There is no need to specify the application when using a well known port on the Layer 4 policy. For Virtual IP Interface configuration, the Application parameter must be set to Virtual IP Interface. Applications supported include:
	Any FTP Control HTTP HTTPS PING REXEC RSH SCTP SIP   Default: Any	RTSP TS COOKIE RADIUS TCP TFTP UDP Virtual IP Interface MH-SCTP (MultiHoming SCTP) Generic-SSL (with Layer 4 Port defined)
Source IP From	Starting address of range of client IPs for which policy provides services.
Source IP To	Last address of range of client IPs for which policy provides services.
Segment Name	Name of segment to which this Layer 4 policy belongs. Also see Segmentation with AppDirector.
Policy Actions
Farm Name	Farm providing services for traffic matching this policy. If a Layer 7 policy is configured, this parameter is not available. Default: None
Layer 7 Policy Name	Select from a predefined policy. Determines that Layer 7 farm selection must be applied to the traffic that matches the Layer 4 Policy. Default: None Note: This feature is HTTP dependent and cannot be used with Generic-SSL offloading, if selected in the Layer 4 Policy Application.
HTTP Policy	Defines HTTP traffic related parameters both in terms of classification and traffic handling. A default HTTP policy is linked to any new Layer 4 policy. Also see HTTP Policies.
TCP Policy	Select a predefined TCP Policy to enable back-end connection pooling for a generic TCP. This lets you reuse existing TCP connections to back-end application servers, reducing both the handshake time and processing overhead of establishing new TCP connections on the back-end application server to serve subsequent requests. Default: None
SSL Policy	Select a predefined SSL policy to enable SSL offload for traffic matching the Layer 4 policy. An SSL policy specifies SSL related behavior such as service server certificate, allowed Cipher suites and more. See SSL Policies for details. Default: None
Caching Policy	Select a predefined Caching policy to enable caching for HTTP traffic matching the Layer 4 policy. See Caching Policies for details. Default: None Note: This feature is HTTP dependent and cannot be used with Generic-SSL offloading, if selected in the Layer 4 Policy Application.
Compression Policy	Select predefined Compression policy to enable compression on the HTTP traffic matching the Layer 4 policy. Also see Compression Policies. Default: None Note: This feature is HTTP dependent and cannot be used with Generic-SSL offloading, if selected in the Layer 4 Policy Application.
Client Authentication Policy	Select predefined Client Authentication policy to enable Client authentication for SSL offload on HTTPS traffic matching the Layer 4 policy. For details, see Client Authentication Policies. Default: None
Policy Settings
Redundancy Status	Defines whether this policy is active for main or backup platform. Values: Primary, Backup Default: Primary Notes:   This is not relevant when operating in an Active-Backup VRRP redundant configuration. The Layer 4 policy redundancy status has no affect on VRRP configurations. In these configurations, the status is derived from platforms associated with the VRID that is bound to the policy.
Backend Encryption Port (AppXcel Users)	For users who also have an AppXcel platform, this parameter sets the port to which an AppXcel platform sends the back-end host encrypted traffic. The Backend Encryption Port must be set to the same value as the Server Port in the tunnel defined on AppXcel.

4.	Click Set.