Showing results for 
Search instead for 
Did you mean: 

Using PBR to override a (loopback) directly connected network


I been using a workaround to overcome the limitation of a non-cisco network router that I have (which can't do OSPF). It connects to a Cisco based network which uses OSPF. But, I can't use that workaround anymore. So I need a new workaround or hack. The working idea is the thread topic. I don't know if it is viable though. So I'd appreciate a look over, once-over, or double check on my thought process, logic, and implementation.

I have a Ubiquiti Dream Machine Pro (UDMP) this services my household's networking needs. It talks to the extensive Cisco basement lab network (2 5505 ASA, 2 3825 ISR, 2 3560 L3/MLS, 3 L2-only 2950). Unfortunately, the UDMP is only capable of static routes. For whatever reason Ubiquiti has not see it fit to implement OSPF or even RIP on it.

I didn't want to take the admin hit of using static routes throughout the basement Cisco network - so as a quick and dirty way - how I solved the problem, was that I connected (to the basement Cisco network) a Ubiquiti EdgeRouter which can do OSPF. I implemented the networks that the UDMP uses on the EdgeRouter. I have the ER inject the networks into OSPF. This points traffic from the basement Cisco equipment that is destined to the UDMP, in the right direction. Then, when that traffic destined for the UDMP, reaches the right L3 router I use a single static route to override the OSPF route (from the ER) and to redirect the traffic to the UDMP which actually has the networks. This way if I make any network changes on the UDMP, then, I don't have to rework a bunch of static routes on the basement Cisco gear. Instead, I make one change on the EdgeRouter to implement any network changes I've made on the UDMP.

However, I now need to repurpose that EdgeRouter so I can't use this workaround anymore. And since the AD of directly connected networks trumps static routes - I can't just use a static route anymore to override a loopback network.

So I went looking and found Policy Based Routing. This How does Internet Work site states definitively that, yes, PBR will override directly connected networks. So, on the Cisco L3 switch connected to the UDMP, I created loopback interfaces for the UDMP networks and made those loopbacks /24 networks. Advertise them into OSPF. Setup an ACL to identify UDMP destine traffic, create the route-map, and then apply the route-map to on the 3650 L3 switch interfaces and VLANs. What I'm trying to achieve is a sort of, "Hey, if you get traffic for the UDMP networks - don't even look at the routing table, the next hop IP for that traffic is x.x.x.x"

The (/24 loopback network) routes for the UDMP networks appear in OSPF and, using traceroute, all the other devices can correctly route traffic for the UDMP to the correct L3 switch. Unfortunately, it just isn't working.

"show route-map <routemap>" doesn't show any hits. Neither does "debug ip policy" show any activity. So either I'm missing something and this isn't a usable workaround or I've incorrectly configured the PBR.

Presuming this is possible I can then provide config from the L3 switch.

12 Replies 12

Richard Burts
Hall of Fame Guru Hall of Fame Guru
Hall of Fame Guru

I find your explanation confusing and admit that I have a very incomplete understanding of your environment. You do seem to have an impressive basement lab network. So let me start with a question. Is there a single L3 device that forwards traffic to UDMP or are there multiple L3 devices that communicate directly with UDMP?



Thank you. Yes, I do take pride in the extensive basement lab I created. It's around 10 years old at this point. I used monies I had acquired from my early tech support positions to support the development of my networking knowledge. As I learned about networking though Cisco Academy classes, I decided that I wanted to practically (but permanently) implement the things that I was learning about. This lab basement isn't about solving any problem. It's just been a playground for me to learn, experiment, and (in a safe non-impacting way) learn from problems. It's design is over-kill, non-sensical, janky even. But, the knowledge I've gained from building and maintaining it has been my golden ticket to helping businesses and individuals and my paycheck.

complete topology.jpg

Mew (the c3560) in the basement network communicates to the UDMP. I setup an individual /30 network ( between them. Mew is and the UDMP is

As it stands right now - the EdgeRouter covers the UDMPs lack of OSPF support. That is, I implement the networks the UDMP has (a data lan, IoT lan, Guest lan, Workbench lan, and Surveillance camera lan) and injects them into the basement Cisco network. So from the home network, when I want to communicate to something in the basement, I have routing back! The basement traffic would otherwise end up being routed to the EdgeRouter - but on Mew I use static routing to override OSPF, or provide a more trustworthy route, to the UDMP which is So the EdgeRouter gets UDMP traffic going in the correct direction (towards Mew), but once it gets to Mew - I told Mew to just redirect it to the UDMP (instead of the EdgeRouter).

So here's the change and why I can't (or don't want to) use the EdgeRouter for this workaround. I got a new townhome and I want to use that EdgeRouter now to create a new network at the townhome. (and perhaps create a site-to-site IPSec VPN to connect it to the Cisco Lab and Home network).

Therefore ... I need to (or would like to) find a way to still cover for the UDMPs lack of OSPF. The idea being - create loopbacks on Mew itself. And then, in similar fashion, just override those loopback interface / networks and redirect to the UDMP.

Of course, yes - I could just buy another EdgeRouter, or any OSPF capable device and continue "the hack". But, I thought it be a good thought experiment and excuse to implement PBR into my basement network.

TBH, I don’t see a problem redesigning this network for full commutation, From that diagram you don’t need the edge router to route for the UDMP device, you have enough L3 devices already to perform all the routing for your basement network.

I believe in the KISS approach and to me if the UDMP device has L3 ip address and is able to route (even if static routing) then why not make the 3825s perform the inter-vlan routing (running a FHRP such as HSRP/VRRP for your basement network/ subnets (include the UDMP network and whatever resides behind it) then advertise those networks between your ASA's/ external wan device for internet/NAT access, Lastly have the 3560s trunks carry your basement vlans around your LAN with that UDMP being assigned to one of those vlans.

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards