Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

POLICY BASE ROUTING

Hi experts,

  • •1)      I have configured 4 VLANS on my L3 switch.
  • •2)       I have one router which has connected 2 ISP link
  • •3)      L3 switch & router has connected each other through L3 link.(which has different subnet)
  • •4)      VLANS on L3 switch ( vlan10 , vlan20, vlan30, vlan40 ) each vlan has 24bit subnet
  • •5)      I want to pass vlan 10 , 20 through ISP1 & vlan 30, 40 through ISP2
  • •6)      If  anyone ISP  link fail all VLANS should be carried through remaining backup link
  • •7)      Please find the topology below

Please Assist..

Everyone's tags (3)
8 REPLIES
New Member

POLICY BASE ROUTING

You must use IP SLA and route map.

You need check availability and chenge next-hop

As example, in route map:

set ip next-hop verify-availability  10 track XXX
set ip next-hop verify-availability 20 track YYY

And add route map on interface or SVI


------------------------------------------------------ Helping seriously ill children, all together. All information about this, is posted on my blog
New Member

POLICY BASE ROUTING

Dear Oleg,

  I have done that all things which have you mentioned. but my question is what access-list should be created for vlans to send them L3 switch to router. Otherwise how could be the router send vlan 10, 20  through ISP1 & vlan 30, 40 through ISP2...

Regards

Suhas

New Member

POLICY BASE ROUTING

Example:

We have two VLAN at catalyst:

one - 192.168.1.0/24

two - 192.168.2.0/24

Outside interfaces

(in my example, it is two subinterfaces)

interface GigabitEthernet0/0

no ip address

duplex auto

speed auto

interface GigabitEthernet0/0.1

encapsulation dot1Q 1 native

ip address 172.16.4.112 255.255.255.0

ip nat outside

ip virtual-reassembly

no snmp trap link-status

Gateway for this interface is 172.16.4.1

interface GigabitEthernet0/0.2

encapsulation dot1Q 2

ip address 192.168.55.210 255.255.255.0

ip nat outside

ip virtual-reassembly

no snmp trap link-status

Gateway for this interface is 192.168.55.1

interface GigabitEthernet0/1

ip address 192.168.33.1 255.255.255.252

ip nat inside

ip virtual-reassembly

ip policy route-map VLANWEB

duplex auto

speed auto

It is interface to catalyst

route-map NATR1 permit 10

match ip address NATACL

match interface GigabitEthernet0/0.1

route-map NATR2 permit 10

match ip address NATACL

match interface GigabitEthernet0/0.2

route-map VLANWEB permit 10

match ip address VLAN1ACL

set ip next-hop 192.168.55.1

route-map VLANWEB permit 20

match ip address VLAN2ACL

set ip next-hop 172.16.4.1

ip access-list extended NATACL

permit ip 192.168.1.0 0.0.0.255 any

permit ip 192.168.2.0 0.0.0.255 any

ip access-list extended VLAN1ACL

permit ip 192.168.1.0 0.0.0.255 any

ip access-list extended VLAN2ACL

permit ip 192.168.2.0 0.0.0.255 any

ip nat inside source route-map NATR1 interface GigabitEthernet0/0.1 overload

ip nat inside source route-map NATR2 interface GigabitEthernet0/0.2 overload

ip route 192.168.1.0 255.255.255.0 192.168.33.2

ip route 192.168.2.0 255.255.255.0 192.168.33.2

Example debug out

*Aug  9 20:51:27.439: NAT*: s=192.168.2.18->172.16.4.112, d=8.8.8.8 [3643]


*Aug  9 20:53:21.899: NAT*: s=192.168.1.18->192.168.55.210, d=8.8.8.8 [4135]

But You need added in this example IP SLA tracker

And well be good if You, done this, public Your config in this forum

Thanks!

------------------------------------------------------ Helping seriously ill children, all together. All information about this, is posted on my blog
New Member

POLICY BASE ROUTING

I modify config for support backup ISP

interface GigabitEthernet0/1

ip address 192.168.33.1 255.255.255.252

ip nat inside

ip policy route-map VLANWEB


interface GigabitEthernet0/0.1

encapsulation dot1Q 1 native

ip address 172.16.4.112 255.255.255.0

ip nat outside

ip virtual-reassembly in


interface GigabitEthernet0/0.2

encapsulation dot1Q 2

ip address 192.168.55.210 255.255.255.0

ip nat outside

ip virtual-reassembly in


ip sla 1

icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0.1


ip sla schedule 1 life forever start-time now


ip sla 2

icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0.2


ip sla schedule 2 life forever start-time now


track 123 ip sla 1 reachability


track 124 ip sla 2 reachability


ip access-list extended ISP1_SLA

permit icmp host 172.16.4.112 any


ip access-list extended ISP2_SLA

permit icmp host 192.168.55.210 any


route-map RMAP_SLA permit 10

match ip address ISP2_SLA

set ip next-hop 192.168.55.1


route-map RMAP_SLA permit 20

match ip address ISP1_SLA

set ip next-hop 172.16.4.1


ip local policy route-map RMAP_SLA


ip access-list extended VLAN1ACL

permit ip 192.168.1.0 0.0.0.255 any


ip access-list extended VLAN2ACL

permit ip 192.168.2.0 0.0.0.255 any


route-map VLANWEB permit 10

match ip address VLAN1ACL

set ip next-hop verify-availability 192.168.55.1 10 track 124

set ip next-hop verify-availability 172.16.4.1 20 track 123


route-map VLANWEB permit 20

match ip address VLAN2ACL

set ip next-hop verify-availability 172.16.4.1 10 track 123

set ip next-hop verify-availability 192.168.55.1 20 track 124


ip access-list extended NATACL

permit ip 192.168.1.0 0.0.0.255 any

permit ip 192.168.2.0 0.0.0.255 any


route-map NATR1 permit 10

match ip address NATACL

match interface GigabitEthernet0/0.1


route-map NATR2 permit 10

match ip address NATACL

match interface GigabitEthernet0/0.2


ip nat inside source route-map NATR1 interface GigabitEthernet0/0.1 overload

ip nat inside source route-map NATR2 interface GigabitEthernet0/0.2 overload


ip route 0.0.0.0 0.0.0.0 172.16.4.1 20 track 123

ip route 0.0.0.0 0.0.0.0 192.168.55.1 10 track 124


event manager applet ISPSW

event track 123 state any

action 1 cli command "enable"

action 2 cli command "clear ip nat trans forced"

 

event manager applet ISPSW2

event track 124 state any

action 1 cli command "enable"

action 2 cli command "clear ip nat trans forced"

------------------------------------------------------ Helping seriously ill children, all together. All information about this, is posted on my blog
New Member

POLICY BASE ROUTING

Hi Oleg,

   What configuration should be done at L3 switch.

Regards

Suhas

VIP Purple

POLICY BASE ROUTING

New Member

POLICY BASE ROUTING

At L3 switch You must have two SVI interfaces for each VLAN (IP ddress at this interfaces should be use as gateway for PC in this VLAN).

And You must set default route to Your router (ip route 0.0.0.0 0.0.0.0 xx.xx.xx.xx or ip default-gateway xx.xx.xx.xx (where xx.xx.xx.xx IP address of Your router)) and enable ip routing.

At L3 switch You must have two SVI interfaces for each VLAN (IP ddress at this interfaces should be use as gateway for PC in this VLAN).

And You must set default route to Your router (ip route 0.0.0.0 0.0.0.0 xx.xx.xx.xx or ip default-gateway xx.xx.xx.xx (where xx.xx.xx.xx IP address of Your router)) and enable ip routing.

------------------------------------------------------ Helping seriously ill children, all together. All information about this, is posted on my blog
New Member

POLICY BASE ROUTING

Dear Sandeep, in Your example, You do not use backup route patch for each VLAN

------------------------------------------------------ Helping seriously ill children, all together. All information about this, is posted on my blog
652
Views
9
Helpful
8
Replies
CreatePlease to create content