Policy based routing

unixsurfer · ‎11-28-2008

Hello there,

I have a question about implementing Policy Based Routing on a 7301 router which is being used as a LB (ip slb).

Currently, traffic is being sent to the farms and there are several static routes which make sure the traffic is routed correctly.

Now, I want traffic with specific destination ports to be routed to a specific next hop(router) and not to be sent to the farms.

So, I thought to create a access list for each destination port and then use route-map to send to the next hop.

But, there few things that aren't clear to me.

How can I make sure that the traffic which doesn't match the access list will be routed as being routed right now?

How will the packet travel through the stuck?

First it goes to slb stuck and then the access list is applied or the other way around?

Since the access list is applied on the inbound interface, I think first the access list is applied.

I hope I am clear,

Pavlos

Giuseppe Larosa · ‎11-28-2008

Hello Pavlos,

traffic that doesn't match the route-map is normally routed no filtering effect in PBR

PBR needs to be the first one to examine the incoming traffic so you need to apply it on interfaces on which the user traffic is received.

Hope to help

Giuseppe

unixsurfer · ‎11-29-2008

Hi,

This matches what is written in this http://www.cisco.com/warp/public/732/Tech/plicy_wp.htm

---------------------------

The route map statements can also be marked as permit or deny. If the statement is marked as a deny, the packets meeting the match criteria are sent back through the normal forwarding channels (in other words, destination-based routing is performed). Only if the statement is marked as permit and the packets meet the match criteria are all the set clauses applied. If the statement is marked as permit and the packets do not meet the match criteria, then those packets are also forwarded through the normal routing channel.

------------------------------------

Furthermore, I am a bit confused about the difference between set ip next-hop and set ip default next-hop.

In this page http://www.cisco.com/en/US/partner/docs/ios/iproute/configuration/guide/irp_ip_prot_indep_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1056703

the following is mentioned.

The set ip next-hop and set ip default next-hop commands are similar but have a different order of operation. Configuring the set ip next-hop command causes the system to use policy routing first and then use the routing table. Configuring the set ip default next-hop causes the system to use the routing table first and then policy-route the specified next hop.

I can't understand how a packet will be routed when I have set ip next-hop A and there is route for the destination network of the packet which routes the packets to B.

According to the above the policy routing is used first so the packet will be routed to A.

But, if I have set ip default next-hop A and there is a route for the destination network of the packet which routes the packets to B, the packet will be routed to B because the routing table is used first.

Did I get it right?

Thank you very much for your reply, I am very much appreciated

Pavlos

Giuseppe Larosa · ‎11-30-2008

Hello Pavlos,

set ip next-hop A will perform its action regardless of the routing table information about the destination of the packet.

Instead, set ip default next-hop will perform its action only if there isn't a specific route for the packet destination: if the packet would be routed following the default route then this set command says : instead of forwarding the packet following the default route use this next-hop.

This is the difference between the two commands and of course the first one is the one to be used in most scenarios.

In other words the set ip default next-hop and set default interfaces have the capability to divert only packets that would be routed by the default route.

>> if I have set ip default next-hop A and there is a route for the destination network of the packet which routes the packets to B, the packet will be routed to B because the routing table is used first.

Yes, it is correct.

Hope to help

Giuseppe