topic Re: Cannot apply a policy-map on interface because of Flowspec IOS XR in Network Security

Cannot apply a policy-map on interface because of Flowspec IOS XR

Louey — Tue, 03 Jan 2023 10:09:38 GMT

I need to apply a policy on my router interface to change the next-hop for some packet source IPs so it could be redirected to a specific transit. I applied a Policy-map PBR on an ingress interface on Cisco XR ASR9000 but the commit does not work and here is the log :

!! SEMANTIC ERRORS: This configuration was rejected by

!! the system due to semantic errors. The individual

!! errors with each failed configuration command can be

!! found below.

interface Bundle-Ether2.10

service-policy type pbr input PM_IP_SFR_Sortie_NAT

!!% 'PBR' detected the 'warning' condition 'BGP FS policy already applied to an interface or traditional policy applied to an interface'

Flowspec is enabled on all interfaces for DDoS and we cannot disable it.

Someone can help with this please ?

Regards

Louey

Re: Cannot apply a policy-map on interface because of Flowspec IOS XR

Stratforders — Wed, 04 Jan 2023 04:13:22 GMT

That’s an useful feature because we can develop a program executed on the router itself to convert the flowspec rules received into configuration line. That’s exactly what the bgpfs2acl script is doing.

MyGeorgiaSouthern.edu

Re: Cannot apply a policy-map on interface because of Flowspec IOS XR

fssabati — Tue, 03 Jan 2023 10:40:14 GMT

Hi @Louey

Can you please share the configuration of that interface .

Regards

Sharanya

Re: Cannot apply a policy-map on interface because of Flowspec IOS XR

Mark Elsen — Tue, 03 Jan 2023 10:40:44 GMT

- Review this thread : https://community.cisco.com/t5/routing/got-error-when-applying-pbr-on-asr9010/td-p/4076635

Re: Cannot apply a policy-map on interface because of Flowspec IOS XR

Louey — Tue, 03 Jan 2023 10:52:32 GMT

Here is the interface config :

interface Bundle-Ether2.10
description Server: VLAN10 - Interco Public_Network_and_Transit9
ipv4 mtu 1500

ipv4 address 10.10.10.1 255.255.255.192

encapsulation dot1q 10

And here is the policy-map

policy-map type pbr PM_IP_SFR_Sortie_NAT
class type traffic CM_IP_SFR_Sortie_NAT
redirect ipv4 nexthop x.x.x.x

ex
!

Re: Cannot apply a policy-map on interface because of Flowspec IOS XR

Louey — Tue, 03 Jan 2023 10:53:46 GMT

No solution on the post unfortunately.

Thanks