Policy-based Routing and Secondary Interfaces

[TODD BEERS]

In order to do non-intrusive testing with an inline device between router and switch, we've set up the following:

Router

Int g0/0

ip address 10.1.1.1 255.255.255.252

ip address 192.168.1.2 255.255.255.248 secondary

Switch

int vl638

ip address 10.1.1.2 255.255.255.252

ip address 192.168.1.1 255.255.255.248 secondary

(Pending) ip route 10.17.0.0 255.255.0.0 192.168.1.2

The remote subnet we're using for testing is 10.17.0.0/16 and its destination subnets are in 10.1.0.0/16. I created the following PBR to avoid asymmetrical routing, but I haven't applied it yet. Most of the traffic is originated from the 10.17.0.0/16 end. 

access-list 113 permit 10.17.0.0 0.0.255.255 any

route-map Testing permit 10
match ip address 113
set ip next-hop 192.168.1.1

int g0/0
ip policy route-map Testing

Will this ensure that all of the traffic flowing between 10.17.0.0/16 and 10.1.0.0/16 will hit 192.168.1.1 on the way in 1 and 92.168.1.2 on the way back out and not affect any other traffic?

[Diana Karolina Rojas · Accepted solution]

Your configuration only ensure that all the traffic (to any subnet) from 10.17.0.0/16 hit 192.168.1.1, no more, If you only want to ensure the traffic from 10.17.0.0/16 to 10.1.0.0/16 hit the ip 192.168.1.1 you have to use an extended access list like this:

access-list 130

permit ip 10.17.0.0  0.0.255.255 10.1.0.0 0.0.255.255

PD: Remember rate useful answers.

Regards,

[TODD BEERS]

Yeah I figured that would be the case. I'm actually going to start very narrow, then expand, so my initial ACL will be:

access-list 113

permit ip 10.17.3.0 0.0.0.255 10.1.0.0 0.0.255.255

[TODD BEERS]

Can't get any hits to the route map/acl even though I'm generating traffic that should match. Wondering if this just doesn't work with secondary addresses.