GeoSite&GeoIP-VPP Case

This guide provides a step-by-step tutorial for configuring Application-Aware Routing and Security Compliance policies using the GeoSite/GeoIP capabilities of the Asterfusion ET2500 Open Intelligent Gateway running AsterNOS-VPP.

What This Guide Will Accomplish

By following this guide, you will upgrade a basic routed network into an intelligent, application-aware gateway. Unlike traditional Layer 3 routing based solely on IP addresses, this guide demonstrates how to route and filter traffic based on Domain Names (GeoSite) and Geographic Location (GeoIP).

The scenarios covered are:

• Smart Traffic Steering (App-Aware Routing): Configuring the gateway to intelligently identify “Office/SaaS” traffic (e.g., Google) and route it through a dedicated Premium Line, while keeping general traffic on the standard ISP Line.
• Security Compliance (GeoIP & Filtering): Implementing security policies to block employee access to “Gaming/Gambling” categories and restricting internal server access to domestic IP addresses only.

---

Phase 1: Preparation and Environmental Overview

Network Topology Plan

We will utilize the following interfaces to simulate a dual-uplink enterprise environment based on your current lab setup. We use a secondary laptop to simulate the “Premium” gateway for verification purposes.

• Ethernet 1 (WAN 1 - ISP): The standard internet connection (connected to upstream switch).
• Ethernet 2 (WAN 2 - Premium): A simulated low-latency line. We will connect a Laptop here to act as the traffic destination/analyzer.
• Ethernet 3 (LAN): The internal user network.

Target Configuration Plan

The following table outlines the IP addressing scheme we will implement:

Device / Interface	IP Address / Subnet	Gateway	Role
AsterNOS (Eth1)	192.168.200.166/24	192.168.200.1	WAN - ISP Line
(Default Internet Access)
AsterNOS (Eth2)	10.200.200.1/24	10.200.200.2*	WAN - Premium Line
(Simulated Path for Baidu traffic)
AsterNOS (Eth3)	172.16.10.1/24	N/A	LAN Gateway
(Internal User Gateway)
Laptop (Eth2)	10.200.200.2/24	N/A	Traffic Analyzer
(Simulates Premium GW)
Internal PC	172.16.10.100/24	172.16.10.1	Internal User

Note

Note:

• For the Laptop connected to Ethernet 2, you must manually set its static IP to 10.200.200.2. It will capture the traffic steered by the PBR policy.*

Required Tools

• Wireshark: Installed on the Laptop (Eth2) to verify traffic steering.
• Ping / Browser: On the Internal PC to generate traffic.

---

Phase 2: Building the Basic Network

In this phase, we establish the physical connectivity and basic NAT services. We will configure Ethernet 1 as the ISP link and Ethernet 2 as the Premium link. Both interfaces will have NAT enabled to ensure internal users can communicate correctly with external networks (or our simulated probe).

Configuration Steps

Step 1: Configure LAN Interface (Ethernet 3)

Configure the interface connecting to your internal test PC.

BlockQuote sonic# configure terminal

Configure LAN Gateway

sonic(config)# interface ethernet 3 sonic(config-if-3)# ip address 172.16.10.1/24 sonic(config-if-3)# no shutdown sonic(config-if-3)# exit

Step 2: Configure WAN Interfaces (ISP & Premium)

We configure both WAN interfaces with their respective subnets and enable NAT Zone 1 on both to support outbound address translation.

Configure WAN 1 (ISP Line)
sonic(config)# interface ethernet 1
sonic(config-if-1)# ip address 192.168.200.166/24
sonic(config-if-1)# nat-zone 1
sonic(config-if-1)# no shutdown
sonic(config-if-1)# exit
 # Configure WAN 2 (Premium Line / Simulation)
Connect your Laptop here (Static IP: 10.200.200.2)
sonic(config)# interface ethernet 2
sonic(config-if-2)# ip address 10.200.200.1/24
sonic(config-if-2)# nat-zone 1
sonic(config-if-2)# no shutdown
sonic(config-if-2)# exit

### Step 3: Configure Routing and NAT Rules

We set the default route to the ISP and define NAT pools for **both** uplinks. This ensures that whichever path traffic takes (steered by PBR or Default), it gets a valid source IP.

BlockQuote

1. Default Route (Traffic defaults to ISP)

sonic(config)# ip route 0.0.0.0/0 192.168.200.1

2. Enable Global NAT

sonic(config)# nat enable

3. Define NAT Pools # Pool for ISP Line (matches Eth1 IP)

sonic(config)# nat pool ISP_POOL 192.168.200.166 # Pool for Premium Line (matches Eth2 IP) sonic(config)# nat pool PREMIUM_POOL 10.200.200.1

4. Bind NAT Pools to the Rule

Bind for ISP path

sonic(config)# nat binding SNAT_ISP ISP_POOL # Bind for Premium path (Traffic steered here will use this pool) sonic(config)# nat binding SNAT_PREMIUM PREMIUM_POOL

---

Phase 3: Smart Traffic Steering (PBR)

We will now configure Policy Based Routing (PBR) to intelligently hijack Baidu traffic and force it through the Premium Line (Ethernet 2).

Configuration Steps

Step 1: Configure PBR for Smart Steering

We define the policy map.

Note

Note: We include match src-ip 0.0.0.0/0 to satisfy the flow key requirement, combined with geosite BAIDU for application identification.

BlockQuote sonic# configure terminal

Create PBR Map matching Baidu

sonic(config)# pbr-map SMART_STEER seq 10

Base Match: All Source IPs (Required for flow key)

sonic(config-pbr-map)# match src-ip 0.0.0.0/0

Application Match: Specific Domain Category

sonic(config-pbr-map)# geosite BAIDU

Action: Force Next-Hop to Premium Gateway (Laptop)

sonic(config-pbr-map)# set nexthop 10.200.200.2 sonic(config-pbr-map)# exit

Step 2: Apply Policy to LAN Interface

Bind the PBR policy to the interface where traffic enters the gateway (Ethernet 3).

sonic(config)# interface ethernet 3
sonic(config-if-3)# pbr-policy SMART_STEER
sonic(config-if-3)# exit
 # Save Configuration
sonic(config)# exit
sonic# write

![](/media/archbee/9xzyLDTZ3Vgnktp2qfvRu-20251230-064511.png)

***

Phase 4: Security Compliance (ACL + GeoIP)

In this phase, we will shift focus from routing to security. We will deploy an Access Control List (ACL) to block access to specific content categories and restrict traffic based on geographic location.

## Prerequisites: Clean Up PBR Policy

Before applying the new security policies, we must remove the PBR policy configured in Phase 3 to ensure a clean testing environment and avoid policy conflicts.

BlockQuote sonic(config)# interface ethernet 3 # Remove the PBR policy from the LAN interface sonic(config-if-3)# no pbr-policy SMART_STEER sonic(config-if-3)# exit

Configuration Steps

Step 1: Create Security ACL

We define an ACL named SECURE_ACL applied in the inbound direction.

• Rule 10: Blocks all websites classified as “Media” (e.g., BBC, CNN).
• Rule20: Blocks all IP addresses located in China (CN).
• Default Behavior: Traffic not matching these rules will be permitted by default.

Create the IPv4 Layer 3 ACL sonic(config)# access-list L3 SECURE_ACL ingress

Rule 10: Block Media Applications (e.g., CNN)

We use the GeoSite category ‘CATEGORY-MEDIA’ sonic(config-l3-acl-SECURE_ACL)# rule 10 geosite CATEGORY-MEDIA packet-action deny

Rule 20: Deny Domestic Traffic (GeoIP: China)

We use the GeoIP code ‘CN’ sonic(config-l3-acl-SECURE_ACL)# rule 20 geoip CN packet-action deny sonic(config-l3-acl-SECURE_ACL)# exit

Step 2: Apply ACL to LAN Interface

We apply this security policy to the LAN interface. Crucially, we also update the NAT binding. We will replace the global NAT binding with an ACL-based NAT binding. This ensures that only traffic permitted by SECURE_ACL is translated and allowed to access the Internet. BlockQuote sonic(config)# interface ethernet 3 sonic(config-if-3)# acl SECURE_ACL sonic(config-if-3)# exit

sonic(config)# no nat binding SNAT_ISP sonic(config)# nat binding SECURE_BIND ISP_POOL SECURE_ACL

Step 3: Save Configuration

sonic(config)# exit
sonic# write

## Verification (Phase 4)

**1. Verify Media Block**

- **Action:** On the Internal PC, try to access an international media site (e.g., `www.cnn.com`).
- **Result:** The connection should fail/timeout.
- **CLI Validation:** Check the counters to see Rule 10 incrementing.

BlockQuote sonic# show counters acl

2. Verify GeoIP Permit

• Action: Access a China website (e.g., www.baidu.com).
• Result: The connection should fail/timeout (matches Rule 20 Deny).

3. Verify Normal Access

• Action: Try to access a non-media, non-CN site (e.g., a US-based technical site like www.gnu.org or stackoverflow.com).
• Result: Access successful. The traffic does not match Rule 10 or 20, so it is permitted and successfully NATed.

****Conclusion

You have successfully transformed the AsterNOS gateway into an intelligent, application-aware edge device.

• Routing: Traffic is steered based on Application Identity (Google -> Premium Line) using PBR.
• Security: Traffic is filtered based on Content Category (Games) and Geography (CN) using ACLs.