Configuration for PBR on cisco 2801 router

[Whit Hicks]

Can someone help me with the config to route three separate Vlans with subnets to three DSL links across a wireless bridge?  The DSL modems will be connected to the switch ports on a 2801 router across a wireless bridge.  The user groups will need to connect to another 2801 via the switch ports.  I have the config to create three VLANS with dialers on the DSL connected router.  I also have corresponding VLANS on the User "uplink" router.  What I need is the configuration for policy based routing to link each user group to a specific DSL modem on the other side of the bridge.

I would greatly appreciate any help you can lend.

I am attaching a network topology drawing.

[Reza Sharifi]

Have a look at this link with example:

https://supportforums.cisco.com/document/8916/how-configure-pbr

http://www.cisco.com/c/en/us/support/docs/ip/ip-routed-protocols/47121-pbr-cmds-ce.html

HTH

[Ganesh Hariharan]

Can someone help me with the config to route three separate Vlans with subnets to three DSL links across a wireless bridge?  The DSL modems will be connected to the switch ports on a 2801 router across a wireless bridge.  The user groups will need to connect to another 2801 via the switch ports.  I have the config to create three VLANS with dialers on the DSL connected router.  I also have corresponding VLANS on the User "uplink" router.  What I need is the configuration for policy based routing to link each user group to a specific DSL modem on the other side of the bridge.

I would greatly appreciate any help you can lend.

I am attaching a network topology drawing.

Hi,

Also check out the below link with configuration examples depicted.

http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html

Hope it Helps..

-GI

Rate if it Helps.

[Peter Paluch · Accepted solution]

Hi Whit,

I apologize for leaving you hanging in the original thread you've posted some time ago.

First of all, the VLANs will not be spanning across the entire topology. VLANs 11, 12, and 13 on the "left" router will be used only to represent different uplinks to different ISPs, and they will be terminated right at the "left" router. Any VLANs you might create on the "right" router are independent from the ones on the "left" router, and as a result, they will require their own unique IP addresses. This does not mean that the left and right part of your topology will be unable to communicate together; rather, it means that in order for the traffic to pass from one VLAN to another, it needs to be routed rather than switched/bridged, and this is what we definitely want to do.

The VLANs 11, 12, and 13 at the left side of your topology exhibit do not require your address assignments. These VLANs will be used to carry PPPoE traffic from and to the individual ISPs. There will be no IP endpoints in these VLANs, and as a result, these VLANS neither require nor use IP addresses themselves. Any IP addresses your ISPs will assign you will be used by Dialer interfaces that are not directly bound to any VLAN.

The network between your "left" and "right" router can use any private IP address you like. For the sake of simplicity, let's assume it is 192.168.255.0/24.

Following is an example of a possible configuration of your "left" router (the relevant parts):

hostname Left
!
vlan 11
 name ISP1
vlan 12
 name ISP2
vlan 13
 name ISP3
!
no spanning-tree vlan 11-13
!
interface FastEthernet0/1/0
 description => To ISP1 DSL modem <=
 switchport mode access
 switchport access vlan 11
!
interface FastEthernet0/1/1
 description => To ISP2 DSL modem <=
 switchport mode access
 switchport access vlan 12
!
interface FastEthernet0/1/2
 description => To ISP3 DSL modem <=
 switchport mode access
 switchport access vlan 13
!
interface FastEthernet0/0
 description => To the RIGHT router <=
 ip address 192.168.255.1 255.255.255.0
 ip nat inside
 ip policy route-map PBR
 no shutdown
!
interface Vlan11
 description => PPPoE Client for ISP1 <=
 pppoe-client dial-pool-number 1
 no shutdown
!
interface Vlan12
 description => PPPoE Client for ISP2 <=
 pppoe-client dial-pool-number 2
 no shutdown
!
interface Vlan13
 description => PPPoE Client for ISP3 <=
 pppoe-client dial-pool-number 3
 no shutdown
!
interface Dialer1
 description => ISP1 Connection <=
 encapsulation ppp
 mtu 1492
 ip address negotiated
 ip adjust-mss 1452
 ip nat outside
 ppp pap sent-username ISP1Login password ISP1Password
 ppp chap hostname ISP1Login
 ppp chap password ISP1Password
 dialer pool 1
!
interface Dialer2
 description => ISP2 Connection <=
 encapsulation ppp
 mtu 1492
 ip address negotiated
 ip adjust-mss 1452
 ip nat outside
 ppp pap sent-username ISP2Login password ISP2Password
 ppp chap hostname ISP2Login
 ppp chap password ISP2Password
 dialer pool 2
!
interface Dialer3
 description => ISP3 Connection <=
 encapsulation ppp
 mtu 1492
 ip address negotiated
 ip adjust-mss 1452
 ip nat outside
 ppp pap sent-username ISP3Login password ISP3Password
 ppp chap hostname ISP3Login
 ppp chap password ISP3Password
 dialer pool 3
!
ip access-list standard AllInternal
 permit 192.168.0.0 0.0.255.255
!
ip access-list standard Net11
 permit 192.168.11.0 0.0.0.255
!
ip access-list standard Net12
 permit 192.168.12.0 0.0.0.255
!
ip access-list standard Net13
 permit 192.168.13.0 0.0.0.255
!
route-map NAT-ISP1 permit 10
 match ip address AllInternal
 match interface Dialer1
!
route-map NAT-ISP2 permit 10
 mach ip address AllInternal
 match interface Dialer2
!
route-map NAT-ISP3 permit 10
 match ip address AllInternal
 match interface Dialer3
!
route-map PBR permit 10
 match ip address Net11
 set interface Dialer1
!
route-map PBR permit 20
 match ip address Net12
 set interface Dialer2
!
route-map PBR permit 30
 match ip address Net13
 set interface Dialer3
!
ip nat inside source route-map NAT-ISP1 interface Dialer1 overload
ip nat inside source route-map NAT-ISP2 interface Dialer2 overload
ip nat inside source route-map NAT-ISP3 interface Dialer3 overload
!
track 1 interface Dialer1 ip routing
track 2 interface Dialer2 ip routing
track 3 interface Dialer3 ip routing
!
ip route 0.0.0.0 0.0.0.0 Dialer1 track 1
ip route 0.0.0.0 0.0.0.0 Dialer2 track 2
ip route 0.0.0.0 0.0.0.0 Dialer3 track 3
!
router eigrp 1
 no auto-summary
 network 192.168.255.1 0.0.0.0
 redistribute static metric 100000 1 255 1 1500

The "right" router would then be configured as follows:

hostname Right
!
vlan 11
 name LAN11
vlan 12
 name LAN12
vlan 13
 name LAN13
!
interface FastEthernet0/1/0
 description => LAN11 <=
 switchport mode access
 switchport vlan 11
!
interface FastEthernet0/1/1
 description => LAN12 <=
 switchport mode access
 switchport access vlan 12
!
interface FastEthernet0/1/2
 description => LAN13 <=
 switchport mode access
 switchport access vlan 13
!
interface Vlan11
 description => LAN11 routed interface <=
 ip address 192.168.11.1 255.255.255.0
!
interface Vlan12
 description => LAN12 routed interface <=
 ip address 192.168.12.1 255.255.255.0
!
interface Vlan13
 description => LAN13 routed interface <=
 ip address 192.168.13.1 255.255.255.0
!
interface FastEthernet0/0
 description => To the LEFT router <=
 ip address 192.168.255.2 255.255.255.0
 no shutdown
!
router eigrp 1
 no auto-summary
 network 192.168.11.1 0.0.0.0
 network 192.168.12.1 0.0.0.0
 network 192.168.13.1 0.0.0.0
 network 192.168.255.1 0.0.0.0

As this configuration is fairly extensive, even though repetitive, I am not going to explain every part of it at this point. Instead, I would like you to give it a thorough review and come back with any questions, even minor ones, about any aspect of it you would like to have clarified.

Looking forward to hearing from you.

Best regards,
Peter

[Whit Hicks]

Peter,

This is fantastic!  I have tow 2801 routers set up in the lab to test the setup.  I will get these configurations on them and see where I have questions as I do it.  I am so glad you are still out there.

More to come shortly.

Whit

[Whit Hicks]

Peter,

There must be something missing here:

1414(config-if)#router eigrp 1
IP routing not enabled
1414(config)# no auto-summary
                     ^
% Invalid input detected at '^' marker.

1414(config)# network 192.168.11.1 0.0.0.0
                     ^
% Invalid input detected at '^' marker.

1414(config)# network 192.168.12.1 0.0.0.0
                     ^
% Invalid input detected at '^' marker.Whit

1414(config)# network 192.168.13.1 0.0.0.0
                     ^
% Invalid input detected at '^' marker.

Can you tell me what I need to change?

Thanks,

[Jon Marshall]

Looks like you need to enable routing -

"ip routing"

Jon

[Whit Hicks]

Peter,

Here is the running config on the "Left" router.  I have one question.  I asked the ISP to bridge the modems, so do we need the user name and password?  If so, I'll have to track that down.

Whit

Delta#sh run
Building configuration...

Current configuration : 3790 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Delta
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$8zzv$WKTJT3jG9NS95fZKvpsb7.
enable password
!
no aaa new-model
!
!
dot11 syslog
no ip routing
no ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
voice-card 0
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
 log config
  hidekeys
!
!
!
!
!
!
interface FastEthernet0/0
 description => To the 1414router <=
 ip address 192.168.255.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 no ip route-cache
 ip policy route-map PBR
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.150.1 255.255.255.0
 no ip route-cache
 speed auto
 full-duplex
 no mop enabled
!
interface FastEthernet0/1/0
 description => To ISP1 DSL modem <=
 switchport access vlan 11
 shutdown
!
interface FastEthernet0/1/1
 description => To ISP2 DSL modem <=
 switchport access vlan 12
 shutdown
!
interface FastEthernet0/1/2
 description => To ISP3 DSL modem <=
 switchport access vlan 13
 shutdown
!
interface FastEthernet0/1/3
 shutdown
!
interface FastEthernet0/1/4
 shutdown
!
interface FastEthernet0/1/5
 shutdown
!
interface FastEthernet0/1/6
 shutdown
!
interface FastEthernet0/1/7
 shutdown
!
interface FastEthernet0/1/8
 shutdown
!
interface FastEthernet0/3/0
 shutdown
!
interface FastEthernet0/3/1
 shutdown
!
interface FastEthernet0/3/2
 shutdown
!
interface FastEthernet0/3/3
 shutdown
!
interface Vlan1
 no ip address
 no ip route-cache
 shutdown
!
interface Vlan11
 description => PPPoE Client for ISP1 <=
 no ip address
!
interface Vlan12
 description => PPPoE Client for ISP2 <=
 no ip address
!
interface Vlan13
 description => PPPoE Client for ISP3 <=
 no ip address
!
interface Dialer1
 description => ISP1 Connection <=
 mtu 1492
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 ppp chap hostname ISP1Login
 ppp chap password 0 ISP1Password
 ppp pap sent-username ISP1Login password 0 ISP1Password
!
interface Dialer2
 description => ISP2 Connection <=
 mtu 1492
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 2
 ppp chap hostname ISP2Login
 ppp chap password 0 ISP2Password
 ppp pap sent-username ISP2Login password 0 ISP2Password
!
interface Dialer3
 description => ISP3 Connection <=
 mtu 1492
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 3
 ppp chap hostname ISP3Login
 ppp chap password 0 ISP3Password
 ppp pap sent-username ISP3Login password 0 ISP3Password
!
ip forward-protocol nd
!
!
ip http server
no ip http secure-server
ip nat inside source route-map NAT-ISP1 interface Dialer1 overload
ip nat inside source route-map NAT-ISP2 interface Dialer2 overload
!
ip access-list standard AllInternal
 permit 192.168.0.0 0.0.255.255
ip access-list standard Net11
 permit 192.168.11.0 0.0.0.255
ip access-list standard Net12
 permit 192.168.12.0 0.0.0.255
ip access-list standard Net13
 permit 192.168.13.0 0.0.0.255
!
snmp-server community public RO
!
!
!
route-map NAT-ISP1 permit 10
 match ip address AllInternal
 match interface Dialer1
!
route-map NAT-ISP2 permit 10
 match interface Dialer2
!
route-map NAT-ISP3 permit 10
 match ip address AllInternal
 match interface Dialer3
!
route-map PBR permit 10
 match ip address Net11
 set interface Dialer1
!
route-map PBR permit 20
 match ip address Net12
 set interface Dialer2
!
route-map PBR permit 30
 match ip address Net13
 set interface Dialer3
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
 password
 login
!
scheduler allocate 20000 1000
end

Delta#

[Peter Paluch]

Hi Whit,

Exactly as Jon has stated, you currently have your Delta router configured with no ip routing. This makes me wonder quite strongly how did that happen. By default, all recent Cisco routers including the 2801 platform have IP routing activated by default. You would need to explicitly enter the no ip routing command to deactivate it just as shown in the dump of the configuration above. Did you do that? If so, why? Please be cautioned that while there are some guides, even on the Cisco website, out there that show you an example configuration of a router for DSL connectivity having no ip routing configured, these are strongly different from what we're doing here, and I need you now to not let yourself confuse by different sources displaying different examples to configuring things. I will always be providing you with complete and workable configurations that do not need to be supplemented by modifications taken over from different other sources.

So your configuration is currently missing several parts of the configuration I have originally created for you because you had IP routing disabled, and as a result, IP routing-related commands have been reject outright. To correct this, please paste the following lines into your global configuration mode - they are adding all the missing parts:

ip routing
ip cef
!
interface Fa0/1/0
 no shutdown
!
interface Fa0/1/1
 no shutdown
!
interface Fa0/1/2
 no shutdown
!
ip nat inside source route-map NAT-ISP3 interface Dialer3 overload
!
track 1 interface Dialer1 ip routing
track 2 interface Dialer2 ip routing
track 3 interface Dialer3 ip routing
!
ip route 0.0.0.0 0.0.0.0 Dialer1 track 1
ip route 0.0.0.0 0.0.0.0 Dialer2 track 2
ip route 0.0.0.0 0.0.0.0 Dialer3 track 3
!
router eigrp 1
 no auto-summary
 network 192.168.255.1 0.0.0.0
 redistribute static metric 100000 1 255 1 1500

Please have these lines added to your configuration - they should not produce any errors. If they do, please let me know what exact lines those are - and also please post the output of the show version command. I will need to know the version and the feature set of the IOS image you're currently running.

I have one question.  I asked the ISP to bridge the modems, so do we need the user name and password?

I would say so. On DSL, connectivity is, to my best knowledge, never provided as plain "raw" IP directly. Instead, either PPPoE or PPPoA is run, and through these, IP packets are carried. In your case, because you do not have a built-in DSL modem into your 2801 router, PPPoA is not an option, and the only possibility is to run PPPoE. With PPPoE, it is natural that the ISP requires that your PPPoE client (in this case, the 2801 router) authenticates to the ISP before it can be assigned an IP address and given internet access.

Having the modems in the "bridged" mode merely means that whatever Ethernet frames they receive from the router, they just chop them into ATM cells used by DSL, and send them out the DSL interface, and vice versa, without doing any IP routing or additional PPP encapsulation themselves. However, the PPP session originating at your 2801 and terminated somewhere at the ISP still requires your router to prove its identity (i.e. authenticate) to the ISP, and that's why I suppose that the authentication will still be necessary, and you will still need to have proper usernames and passwords configured.

Please try this out and let me know about the progress. Thanks!

Best regards,
Peter

[Whit Hicks]

Peter,

I have no idea why the router had "No ip routing" set.  So far, I wiped the routers to factory, set them back up with management Ips on FA0/1 and set passwords.  Other than that, I have only pasted the configurations you have give me.  Not sure why they would have that default either.

I am contacting the ISP to see what username and password should be used for the modems.

I have connected the Delta router to the 1414 router on ports fa0/0 to act as the wireless bridge.  I cannot ping across that link, or connect to the 1414 router from the Delta router.  Shouldn't I be able to do this?

I entered your last config notes and here is the current running config on the "Delta" router.

See below.

Thanks,

Whit

Delta#sh run
Building configuration...

Current configuration : 4210 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Delta
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$8zzv$WKTJT3jG9NS95fZKvpsb7.
enable password 7 112E18111800290D553E
!
no aaa new-model
!
!
dot11 syslog
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
voice-card 0
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
 log config
  hidekeys
!
!
!
track 1 interface Dialer1 ip routing
!
track 2 interface Dialer2 ip routing
!
track 3 interface Dialer3 ip routing
!
!
!
!
interface FastEthernet0/0
 description => To the 1414router <=
 ip address 192.168.255.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 ip policy route-map PBR
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.150.1 255.255.255.0
 speed auto
 full-duplex
 no mop enabled
!
interface FastEthernet0/1/0
 description => To ISP1 DSL modem <=
 switchport access vlan 11
!
interface FastEthernet0/1/1
 description => To ISP2 DSL modem <=
 switchport access vlan 12
!
interface FastEthernet0/1/2
 description => To ISP3 DSL modem <=
 switchport access vlan 13
!
interface FastEthernet0/1/3
 shutdown
!
interface FastEthernet0/1/4
 shutdown
!
interface FastEthernet0/1/5
 shutdown
!
interface FastEthernet0/1/6
 shutdown
!
interface FastEthernet0/1/7
 shutdown
!
interface FastEthernet0/1/8
 shutdown
!
interface FastEthernet0/3/0
 shutdown
!
interface FastEthernet0/3/1
 shutdown
!
interface FastEthernet0/3/2
 shutdown
!
interface FastEthernet0/3/3
 shutdown
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan11
 description => PPPoE Client for ISP1 <=
 no ip address
!
interface Vlan12
 description => PPPoE Client for ISP2 <=
 no ip address
!
interface Vlan13
 description => PPPoE Client for ISP3 <=
 no ip address
!
interface Dialer1
 description => ISP1 Connection <=
 mtu 1492
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 1
 ppp chap hostname ISP1Login
 ppp chap password 7 013A35340A3B071C325B411B1D
 ppp pap sent-username ISP1Login password 7 0726127C1F3918160405041E00
!
interface Dialer2
 description => ISP2 Connection <=
 mtu 1492
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 2
 ppp chap hostname ISP2Login
 ppp chap password 7 002D2036566B0A151C36435C0D
 ppp pap sent-username ISP2Login password 7 143E213B5E342B38373F3C2726
!
interface Dialer3
 description => ISP3 Connection <=
 mtu 1492
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip tcp adjust-mss 1452
 dialer pool 3
 ppp chap hostname ISP3Login
 ppp chap password 7 0522353F727C4F1A0A1218000F
 ppp pap sent-username ISP3Login password 7 013A3534083B071C325B411B1D
!
router eigrp 1
 redistribute static metric 100000 1 255 1 1500
 network 192.168.255.1 0.0.0.0
 no auto-summary
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer1 track 1
ip route 0.0.0.0 0.0.0.0 Dialer2 track 2
ip route 0.0.0.0 0.0.0.0 Dialer3 track 3
!
!
ip http server
no ip http secure-server
ip nat inside source route-map NAT-ISP1 interface Dialer1 overload
ip nat inside source route-map NAT-ISP2 interface Dialer2 overload
ip nat inside source route-map NAT-ISP3 interface Dialer3 overload
!
ip access-list standard AllInternal
 permit 192.168.0.0 0.0.255.255
ip access-list standard Net11
 permit 192.168.11.0 0.0.0.255
ip access-list standard Net12
 permit 192.168.12.0 0.0.0.255
ip access-list standard Net13
 permit 192.168.13.0 0.0.0.255
!
snmp-server community public RO
!
!
!
route-map NAT-ISP1 permit 10
 match ip address AllInternal
 match interface Dialer1
!
route-map NAT-ISP2 permit 10
 match interface Dialer2
!
route-map NAT-ISP3 permit 10
 match ip address AllInternal
 match interface Dialer3
!
route-map PBR permit 10
 match ip address Net11
 set interface Dialer1
!
route-map PBR permit 20
 match ip address Net12
 set interface Dialer2
!
route-map PBR permit 30
 match ip address Net13
 set interface Dialer3
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
 password 7 082E4941011F150717
 login
!
scheduler allocate 20000 1000
end

[Peter Paluch]

Hello Whit,

The last posted configuration does not appear to have any obvious errors. You are saying that from Delta (the "left" router), you are unable to ping the 1414 (the "right" router). Let's make this clear: When entering the ping 192.168.255.2 on Delta router, no successful responses are received? Definitely, this has to work, and if it doesn't, we have some troubleshooting to do.

Can you confirm in your show ip interface brief on Delta that the FastEthernet0/0 interface is reported as being up/up (both Status and Protocol columns)? Please note that on 2801 and 2811 routers, the on-board FastEthernet ports do not support automatic crossover (auto-MDIX), so if you are testing this configuration in a lab with two routers connected back-to-back, you absolutely have to use a crossover cable.

Best regards,
Peter