(Optional) Configuring an FPI Application
Context
In some cases, if an application fails to be identified upon its first packet, packets of the application may be transmitted along different routes. Packets forwarded through different routes may fail to be forwarded if some routes are unreachable. As a result, a communication failure occurs. To prevent communication failures, you can configure FPI on a device to identify an application based on its first packet and forward the subsequent packets of the application along the same route.
Configuring a User-Defined FPI Application Based on 5-Tuple and/or DSCP Information
Context
Generally, the SA signature database of the system contains signatures of common FPI applications, which can be used to identify various FPI applications. If the built-in predefined FPI applications of the system do not have the signatures of the application to be identified, you can configure a new user-defined FPI application based on its signatures. If you know the 5-tuple and/or DSCP information about the application to be identified, you can configure a user-defined FPI application based on the information to easily identify applications.
Procedure
- Run system-view
The system view is displayed.
- Run sa first-packet
The SA-FPI view is displayed.
- Run user-defined-application name name
The user-defined FPI application is created, and the user-defined FPI application view is displayed.
By default, no user-defined FPI application is created on a device.
- Run rule rule-id [ tcp | udp ] { source source-address source-mask | source-port range sou-port-start sou-port-end | destination destination-address destination-mask | destination-port range des-port-start des-port-end | dscp dscp } *
A rule based on 5-tuple and/or DSCP information is configured for a user-defined FPI application.
By default, no rule is configured based on 5-tuple and/or DSCP information for a user-defined FPI application.
Configuring a User-Defined or Predefined FPI Application Based on the DNS Domain Name
Context
Generally, the SA signature database of the system contains DNS domain names of common FPI applications, which can be used to identify various FPI applications. If the DNS domain name of the application to be identified is present in the predefined SA signature database, you can configure a predefined FPI application based on the DNS domain name to identify applications. If the DNS domain name is not present in the predefined SA signature database, you can configure a user-defined FPI application based on the DNS domain name to identify applications.
Procedure
- Run system-view
The system view is displayed.
- (Optional) Configure a user-defined FPI application based on the DNS domain name as follows:
- Run sa first-packet dns-associated enable
The device is enabled to identify FPI applications through association with the DNS function.
By default, a device is disabled from identifying FPI applications through association with the DNS function.
- (Optional) Run sa first-packet dns-aging-time aging-time
The aging time for DNS mapping entries is configured.
By default, the aging time for DNS mapping entries is 86,400 seconds (24 hours).
Configuring a User-Defined or Predefined FPI Application Based on the Protocol and Port Number
Context
Generally, the SA signature database of the system contains the protocols and port numbers of common FPI applications, which can be used to identify various FPI applications. If the protocol and port number of the application to be identified are present in the predefined SA signature database, you can configure a predefined FPI application based on the protocol and port number to identify applications. If not, you can configure a user-defined FPI application based on the protocol and port number to identify applications.
Procedure
- Run system-view
The system view is displayed.
- (Optional) Run the display first-packet application pre-defined { port | protocol }command to check whether the protocol and port number of the application to be identified are present in the predefined SA signature database. If so, go to 3. If not, configure a user-defined FPI application based on the protocol and port number as follows:
- Run sa first-packet port enable
The device is enabled to identify FPI applications based on the protocol and port number.
By default, a device is disabled from identifying FPI applications based on the protocol and port number.