Policy based routing.. continued

[andy roles]

Hi,

I posted earlier but the post became a bit convoluted.  I've simplified/clarified my question further here:

ip local policy route-map B_INTERNET_OUT

route-map B_INTERNET_OUT permit 10
 match ip address B_INTERNET
 set ip next-hop 10.72.183.129

ip access-list extended B_INTERNET
 deny ip 10.122.37.0 10.122.0.0 0.0.127.255
 permit ip 10.122.37.0 0.0.0.255 any

My question is:

Will the deny statement result in the route-map ignoring traffic that is from src network 10.122.37.0/24 to dst network 10.122.0.0/17 and thus the routing table will take care of the routing. (this is what i want to happen)

If so, then will the route map send all other traffic from 10.122.37.0/24 to the specified next hop of 10.72.183.129?

Many thanks,

Andy

(please ignore all text below - i seem to have embedded this by accident)

ip local policy route-map B_INTERNET_OUT

route-map B_INTERNET_OUT permit 10
 match ip address B_INTERNET
 set ip next-hop 10.72.183.129

ip access-list extended B_INTERNET
 permit ip 10.122.37.0 0.0.0.255 any

- See more at: https://supportforums.cisco.com/discussion/12541486/policy-based-routing-and-changing-default-route-internet-only-one-subnet#sthash.blG93KAl.dpuf

ip local policy route-map B_INTERNET_OUT

route-map B_INTERNET_OUT permit 10
 match ip address B_INTERNET
 set ip next-hop 10.72.183.129

ip access-list extended B_INTERNET
 permit ip 10.122.37.0 0.0.0.255 any

- See more at: https://supportforums.cisco.com/discussion/12541486/policy-based-routing-and-changing-default-route-internet-only-one-subnet#sthash.blG93KAl.dpuf

[Jon Marshall]

Andy

Rick and Peter covered this in the other post.

Two key points -

1) "ip local policy route-map" is the wrong command because that is used for traffic generated by the L3 device itself.

You need to use "ip policy route-map <name>" and you apply it to the interface on the L3 device where the traffic from the 10.122.37.x clients arrives.

2) if you want the 10.122.37.x clients to use the routing table for other internal subnets and use the next hop IP for remote destinations eg. internet then you don't need a deny, you need to use -

"set ip default next-hop x.x.x.x"

in your PBR configuration.

With the above command the routing table is used first before PBR but the default route in your routing table is not used. So any route for other internal subnets is used ie. it does not use your next hop IP but if there is not a specific route ie. only the default route it will not use this and instead will use the next hop IP you have specified.

Jon

[andy roles]

Hi Jon,

Apologies - there was a lot in the other posts and when i looked at the tech info Rick pointed me to I think I misinterpreted it.

I must have cut and paste the other command (ip local policy route-map) in inadverently adding to the confusion as I know the policy need to be applied as you pointed out.

I will re-attempt using the as suggested using the 'set ip default next-hop x.x.x.x' command.

Thank you,

Andy

[Richard Burts]

Andy

As Jon points out set ip default next-hop will get the results that you want and remove the need to the deny statement in your access list. Also as several have pointed out the ip local policy command will only affect packets generated by the router itself. To have it work on the user traffic you need to configure ip policy on the interface of the router that will receive that user traffic.

And one small detail about your access list is that you left out a mask after the first network and the access list as configured would not work.

 deny ip 10.122.37.0 10.122.0.0 0.0.127.255

HTH

Rick

[andy roles]

Thank you Rick!!

Having a stressful old time with last minute changes to requirements atm.  The help from yourself, Jon and Peter is hugely appreciated :o)

Andy

[andy roles]

Hi Jon,

The policy needs applying across multiple hop.  The Path I want the traffic to take is as follows:

H:\>tracert 10.72.183.129

Tracing route to 10.72.183.129 over a maximum of 30 hops

  1    <1 ms    <1 ms     1 ms  10.122.37.254
  2    <1 ms    <1 ms    <1 ms  10.122.47.110
  3    <1 ms    <1 ms    <1 ms  10.122.112.102
  4    <1 ms    <1 ms    <1 ms  10.122.31.138
  5     1 ms     1 ms     1 ms  10.122.31.22
  6     3 ms    <1 ms    <1 ms  10.122.112.126

So I need to apply the policy at each hop.

regarding using the "set ip default next-hop x.x.x.x" statement, the default route in our routing table looks like this:

D*EX 0.0.0.0/0 [170/31232] via 10.122.47.110, 05:42:03, GigabitEthernet1/48

(this was taken from the 6509 switch that is at the first hop.

Will the "set ip default next-hop x.x.x.x" statement/command allow the switches/routers to recognise that this is the default route?

Thank you!

Andy

[Jon Marshall]

Andy

It's not clear exactly what the topology of your network is.

It is also not clear as to whether each next hop needs PBR applied ie. it depends on their default routes and where they are pointing to.

In some cases it is enough to simply divert the traffic once and then the other devices will route correctly but if those other devices have a default route you don't want to use then yes you may well need to use PBR all along the path.

In terms of your route output, yes that is a default route and it should not be used ie. your next hop IP in your PBR configuration should be used instead.

Jon 

[andy roles]

Thanks Jon!

much appreciated.

Basically, we just have three sites connected by dual routers in a triangle with a switch LAN enivronment at each site.  The 'catch all' route at the bottom of the routing table is distirbuted throughout the whole network and the routing table looks pretty much the same on every device.

Thanks for this:

'In terms of your route output, yes that is a default route and it should not be used ie. your next hop IP in your PBR configuration should be used instead'

I'm hoping that'll do the trick if that is the case - i.e. everything from 10.122.107.0/24 will use the routing table apart from the traffic destined for other networks.

Off to the data centre now to implement... I normally do more planning but this requirement came out of nowhere!

Cheers,

Andy

************************** think i've embedded junk again below... cut and paste on this window seemed to do this!************

[Peter Paluch]

Andy,

I may be overly tied to this idea but let me ask once again: Instead of configuring the PBR on each hop, would it not be easier to configure a GRE tunnel between the router that hosts the "relocated" network and the B's network, and do the PBR just at the tunnel endpoint?

Best regards,
Peter

[andy roles]

Hi Peter,

I think the GRE tunnel sounds like a really solution.  I used PBR at each hop + default next-hop command and this worked.  I will revisit and try your method when I have more time.

Big thanks for your input,

Andy