| The default flow mask is the
destination-ip mode. This is also referred to as a destination flow
mask. This mode represents the least-specific flow mask. The MLS-SE
maintains one MLS entry for each destination IP address. All flows
to a given destination IP address use this MLS entry. This flow mask
is used if there are no access lists configured on any of the MLS
router interfaces.
The second type of flow mask is the
source-destination-ip mode. This is also referred to as a
destination-source flow mask. The MLS-SE maintains one MLS entry for
each source and destination IP address pair. All flows between a
given source and destination use this MLS entry regardless of the IP
protocol ports. This mode is used if there is a standard access list
on any of the MLS interfaces.
The final flow mask is the ip-flow
mode. This is also referred to as a full flow mask. This mode
represents the most specific flow mask. The MLS-SE creates and
maintains a separate MLS cache entry for every IP flow. An ip-flow
entry includes the source IP address, destination IP address,
protocol, and protocol ports. This mode is used if there is an
extended access list on any MLS interface.
|