Policy Based Routing with Catalyst 4500

[eduarddav]

Hi,

I have a Cisco Catalyst 4500 and i want to associate a route map for PBR to one of his interfaces.

1) i found out that i can only associate it to interface vlans and not to regular Gigabit interfaces - is it impossible to associate a route map to a layer 2 (switchport) interface?

2) And if it is impossible to associate a route map to a layer 2 (switchport) interface how where should o associate the route map on the switch in order to inspect all outgoing traffic?

3) How to add a general permit to a route map - is it enough to add the line "route-map test permit 40" without anything else or should i add an access list that match anything?

Thanks

[Jon Marshall]

Traffic is only examined by PBR when it is incoming on an interface. So if you have vlans on your switch and L3 vlan interfaces for those vlans then if you apply PBR to those interfaces it will examine traffic coming from clients in those vlans.

My understanding is that you don't want this to happen.

So as regards your switch connection to the rest of IT. It sounds like a vlan is in use. Whatever that vlan is, do you have a L3 interface for it ?

When you checked the arp table what was the other IP address ? Whatever it was it is the IP used the same as the one used in your static routes ie. the next hop ?

Jon

[eduarddav]

Yes, i have an Interface Vlan for the IT connectivity (i.e. - a layer 3 virtual interface). So i have associated the route map there (we haven't tested it yet, but... we'll test it later today).

Question about route maps - when traffic is examined against a route map - which IP is checked at the match close - the packets destination or source address?

[Jon Marshall]

With PBR you use an extended access-list so both are checked eg.

access-list permit ip host 192.168.5.1 host 192.168.6.1

in the above both source and destination IP need to matched to carry out whatever action you have defined with the "set" statement in your route map.

Jon

[eduarddav]

Ok, thanks.

And the entire setup as I described should work?

[Jon Marshall]

Can't say for sure because -

a) we haven't actually verified the topology ie. how your switch connects back to the other switch. From what we have covered it sounds like that is what is happening but can't say for sure.

and more importantly

b) in all this discussion we haven't actually discussed the actual route map and what exactly you want it to achieve.

So for us to say yes it will definitely work would be irresponsible. But from what you have described and assuming your PBR config is correct i would think it work.

Jon