cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1747
Views
0
Helpful
3
Replies

Precedence of PBR next-hop over direct connected route

lcarrau
Level 1
Level 1

Hello!

 

The main objective is to redirect the traffic of all VLANs to an inter-vlan Firewall.

Can I do that with PBR?

The idea is to forward all packets to the firewall without looking on the routing table (Routing table override).

 

Configuration would be like that:

ip access-list standard acl-anyip

  permit any

 

interface Vlan10

   description Network to firewall

   ip address 172.16.0.1 255.255.255.0

   ip policy route-map ivsec

 

interface Vlan100

   ip address 172.16.1.1 255.255.255.0

   ip policy route-map ivsec

 

interface Vlan200

   ip address 172.16.2.1 255.255.255.0

   ip policy route-map ivsec

 

route-map ivsec permit 10

  match ip address acl-anyip

  set ip next-hop 172.16.0.2  !Firewall IP Address

 

Please do not be too strict about the config... I took it direct out of my head as an idea.

 

Thanks a lot in advanced.

 

Lanello Carrau

 

 

Switch# show version
Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Version 03.06.02.E RELEASE SOFTWARE (fc1)

2 Accepted Solutions

Accepted Solutions

Gaurav Gambhir
Cisco Employee
Cisco Employee

Yes PBR is the feature to bypass routing table and force the traffic to a different next hop.

 

your config logic also looks good. here is a link for PBR on 4500 as well

 

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/15-1/XE_330SG/configuration/guide/config/pbroute.pdf

View solution in original post

Filip Knezevic
Level 1
Level 1

Hi Lanello,

 

Yes, this should work. Tried in lab:

Capture.PNG

Extended IP access list ALL_TRAFFIC
10 permit ip any any

R2#sh route-map
route-map ALL_TRAFFIC, permit, sequence 10
Match clauses:
ip address (access-lists): ALL_TRAFFIC
Set clauses:
ip next-hop 10.10.23.2
Policy routing matches: 18 packets, 1290 bytes
R2#

 

interface FastEthernet1/1.10
encapsulation dot1Q 10
ip address 10.10.10.1 255.255.255.0
ip policy route-map ALL_TRAFFIC
end

R2(config-subif)#

 

ip route 0.0.0.0 0.0.0.0 10.10.12.2

 

Trace from a 'PC' without route-map:

PC#trace 8.8.8.8
Type escape sequence to abort.
Tracing the route to 8.8.8.8
VRF info: (vrf in name/id, vrf out name/id)
1 10.10.10.1 76 msec 32 msec 28 msec
2 10.10.12.2 28 msec 48 msec 32 msec
3 10.21.10.2 40 msec 52 msec 44 msec
PC#

Trace from a 'PC' with route-map applied:

PC#trace 8.8.8.8
Type escape sequence to abort.
Tracing the route to 8.8.8.8
VRF info: (vrf in name/id, vrf out name/id)
1 10.10.10.1 96 msec 16 msec 28 msec
2 10.10.23.2 64 msec 60 msec 60 msec
3 10.20.10.1 72 msec 60 msec 68 msec
PC#

 

 

View solution in original post

3 Replies 3

Gaurav Gambhir
Cisco Employee
Cisco Employee

Yes PBR is the feature to bypass routing table and force the traffic to a different next hop.

 

your config logic also looks good. here is a link for PBR on 4500 as well

 

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/15-1/XE_330SG/configuration/guide/config/pbroute.pdf

Deepak Kumar
VIP Alumni
VIP Alumni

Hi,

You can do the same with PBR and PBR will precedence over the routing table. Keep in mind that all source and destination networks must match in the ACL "acl-anyip" otherwise nonmatching traffic will route through the normal routing table. 

Regards,
Deepak Kumar,
Don't forget to vote and accept the solution if this comment will help you!

Filip Knezevic
Level 1
Level 1

Hi Lanello,

 

Yes, this should work. Tried in lab:

Capture.PNG

Extended IP access list ALL_TRAFFIC
10 permit ip any any

R2#sh route-map
route-map ALL_TRAFFIC, permit, sequence 10
Match clauses:
ip address (access-lists): ALL_TRAFFIC
Set clauses:
ip next-hop 10.10.23.2
Policy routing matches: 18 packets, 1290 bytes
R2#

 

interface FastEthernet1/1.10
encapsulation dot1Q 10
ip address 10.10.10.1 255.255.255.0
ip policy route-map ALL_TRAFFIC
end

R2(config-subif)#

 

ip route 0.0.0.0 0.0.0.0 10.10.12.2

 

Trace from a 'PC' without route-map:

PC#trace 8.8.8.8
Type escape sequence to abort.
Tracing the route to 8.8.8.8
VRF info: (vrf in name/id, vrf out name/id)
1 10.10.10.1 76 msec 32 msec 28 msec
2 10.10.12.2 28 msec 48 msec 32 msec
3 10.21.10.2 40 msec 52 msec 44 msec
PC#

Trace from a 'PC' with route-map applied:

PC#trace 8.8.8.8
Type escape sequence to abort.
Tracing the route to 8.8.8.8
VRF info: (vrf in name/id, vrf out name/id)
1 10.10.10.1 96 msec 16 msec 28 msec
2 10.10.23.2 64 msec 60 msec 60 msec
3 10.20.10.1 72 msec 60 msec 68 msec
PC#

 

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: