Classification examples
These examples demonstrate how packet classification works in various network configurations and firewall deployment scenarios.
Packet classification with a shared interface using MAC addresses
This figure shows multiple instances sharing an outside interface. The classifier assigns the packet to Instance C because Instance C includes the MAC address to which the router sends the packet.
Incoming traffic from inside networks
Note that all new incoming traffic must be classified, even from inside networks. This figure shows a host on the Instance C inside network accessing the internet. The classifier assigns the packet to Instance C because the ingress interface is Ethernet 1/2.3, which is assigned to Instance C.
Transparent firewall instances
For transparent firewalls, you must use unique interfaces. This figure shows a packet destined to a host on the Instance C inside network from the internet. The classifier assigns the packet to Instance C because the ingress interface is Ethernet 1/2.3, which is assigned to Instance C.
Inline sets
For inline sets, you must use unique interfaces and they must be physical interfaces or EtherChannels. This figure shows a packet destined to a host on the Instance C inside network from the internet. The classifier assigns the packet to Instance C because the ingress interface is Ethernet 1/5, which is assigned to Instance C.
