PBR switch internal routing

[Machi Ma]

Hello,

I am studying PBR now.  With example like

http://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/118156-configure-wsa-00.html

copy and rewrite part of config


---------- vlan ip address ------------
interface Vlan10
desc User VLAN 10
ip address 10.1.1.1 255.255.255.0
!
interface Vlan20
desc User VLAN 20
ip address 10.1.2.1 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 192.168.3.1
---------------------------------------

---- access-list -----
! match source ip 10.1.1.0/24
access-list 100 permit tcp 10.1.1.0 0.0.0.255 any
! Match source ip 10.1.2.0/24
access-list 101 permit tcp 10.1.2.0 0.0.0.255 any
!
-----------------------

---- route-map ----
!
route-map 100traffic permit 100
match ip address 100
set ip next-hop 192.168.1.1
!
route-map 101traffic permit 100
match ip address 101
set ip next-hop 192.168.2.1
!
------Apply to Vlan interface ------------------
!
interface vlan10
ip policy route-map 100traffic
!
interface vlan20
ip policy route-map 101traffic
!

---------------------------------------------------

Question:
1) I have 2 subnet host 10.1.1.0/24 and 10.1.2.0/24 which connected directly to switch now.  According to above config, it looks will re-route to next-hop first and re-route back to the switch? 

2) How can I config inter-vlan switch routing?

Thanks!

[Julio E. Moisa]

Hi

About the question 1, yes that is correct, it will manipulate the traffic to point to a specific next hop, this next hop (layer 3 device) must know how to return the packet to the source, it can be via dynamic routing or static route. 

About the question 2, If you are using a layer 3 switch (or multilayer switch) you need to create the Interface vlans (SVI) and execute the command ip routing globally, it will enable the routing service on the switch.

http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41860-howto-L3-intervlanrouting.html

Now if your switch is a layer 2, you need a layer 3 device, you can implement router in a stick scheme to implement inter-vlan routing. 

http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/336-cisco-router-8021q-router-stick.html

Hope it is useful

:-)

[Machi Ma]

Hello,

The switch itself can be as a L3 switch.

And I think need enable "ip routing" as well?

so what should be correct config for PBR?

----------------------------------------------------------

!

ip routing

!

interface Vlan10
ip address 10.1.1.1 255.255.255.0

no shutdown

!
interface Vlan20
ip address 10.1.2.1 255.255.255.0

no shutdown

!
ip route 0.0.0.0 0.0.0.0 192.168.3.1

!

----------------------------------------

Thanks!

[Julio E. Moisa]

Hi Machi,

Yes, that is correct, but take in consideration you need to create the vlan, assign it to an access port or under a trunk in order to enable the SVI:

vlan 10

int g1/0/1
switchport access vlan 10
switchport mode access 

or 

int g1/0/1
switchport trunk encapsulation dot1q (some switches have it implicit)
switchport mode trunk.

Now, the default route is used if you are going to know everything through a specific neighbor, take in consideration that if you are going to point to the IP 192.168.3.1 as next hop, you should have a SVI with one IP of the same network segment, it will work like a point to point between routers:

So your config could be:

vlan 30

inter vlan 30
ip address 192.168.3.2 255.255.255.252
no shut

interface g1/0/2
description P2P-TO-DEVICE-X
switchport access vlan 30
switchport mode access

ip route 0.0.0.0 0.0.0.0 192.168.3.1

I would like to mention tha the multilayer switches has the capability to convert layer 2 switches to layer 3, it can be completed using

interface g1/0/3
no switchport
ip address 192.168.3.2 255.255.255.252
no shutdown

And example of PBR is:

*Imagine you have 2 routers connected to the switch, a primary router and backup, you could use the PBR to manipulate the traffic to go through the backup router. 

access-list 100 permit tcp 10.1.1.0 0.0.0.255 any


route-map 100traffic permit 100
match ip address 100
set ip next-hop 192.168.3.1

interface vlan10
ip policy route-map 100traffic

Hope it is useful

:-)