13.5 C
New York
Thursday, June 8, 2023

Your #1 Source of Tech News

Influencing Forwarding Behavior with Policy Based Routing

It had been a scorching minute since I final put collectively a weblog, and I used to be enthusiastic about what is likely to be an fascinating subject. Well, as is typical, I thought of what I’d lately run throughout, or labored on, in my “day job” as a part of the engineering workforce that builds and helps the lab environments for all of the Learning at Cisco coaching supplies.

On this specific day, I used to be reviewing the present configurations of the core community routers (layer 3 switches actually) in our information facilities. I’m pretty new to this a part of the workforce, and I used to be to find that we have been leveraging Policy Based Routing to govern the forwarding habits for various kinds of site visitors. I’m positive lots of you studying this weblog are acquainted with the truth that there are all the time a number of methods to perform a job in networking (life actually, however undoubtedly in networking). As such, policy-based routing is a device within the community engineer’s toolkit that may typically be leveraged to deal with “odd business requirements.”

And with that, I had a subject to make use of for this weblog and an accompanying video to kick off a brief video collection known as “Technically Speaking… with Hank Preston” on the Cisco U. by Learning and Certifications YouTube channel. Specifically, we’re going to have a look at how to configure policy-based routing to affect forwarding habits. The why I’ll go away for an additional submit. 🙂

Also, for anybody learning for the CCNP Enterprise certification, policy-based routing is on the ENARSI – Implementing Cisco Enterprise Advanced Routing and Services blueprint – “1.6 Configure and verify policy-based routing.” 300-410 ENARSI is a focus examination that earns you the Cisco Certified Specialist – Enterprise Advanced Infrastructure Implementation certification.  So, it’s undoubtedly a fantastic subject for the Cisco Learning weblog. Let’s dive proper in!

Setting the Stage

Before we have a look at altering the standard routing and forwarding habits, let’s begin with the essential forwarding habits. For this exploration, I put the beneath community collectively in a Cisco Modeling Labs simulation. (You can discover the topology file right here.)

Network Toplogy
The community topology used on this exploration of coverage based mostly routing and forwarding habits.

This community has two small LANs separated by a fundamental, single space OSPF community within the center. The prices within the OSPF community have been configured to make the very best path from R1 to R5 by R3. We can see that in a pair methods.

First, let’s have a look at the interface prices on R1.

R1#present ip ospf interface transient 

Interface    PID   Area            IP Address/Mask    Cost  State Nbrs F/C
Gi0/1.200    1     0        1     DR    0/0
Gi0/1.100    1     0        1     DR    0/0
Gi0/4        1     0           110   DR    1/1
Gi0/3        1     0           1     DR    1/1
Gi0/2        1     0           100   DR    1/1

Notice the prices for interface G0/2 and G0/4 (in the direction of R2 and R4) have a price of 100 and 110 respectively, whereas the price of G0/3 (in the direction of R3) is only one.

And now, we’ll confirm the routing desk entry for host H3 on R1.

R1#present ip route   

Routing entry for
  Known by way of "ospf 1", distance 110, metric 3, sort intra space
  Last replace from on GigabitEthernet0/3, 00:23:02 in the past
  Routing Descriptor Blocks:
  *, from, 00:23:02 in the past, by way of GigabitEthernet0/3
      Route metric is 3, site visitors share rely is 1

The routing desk lists the route as in the direction of R3 out interface G0/3 — precisely as we’d count on.

The closing examine can be a hint route from host H1.

H1:~$ traceroute -n

traceroute to (, 30 hops max, 46 byte packets
 1   5.534 ms  5.004 ms  3.038 ms
 2      5.528 ms  5.531 ms  4.137 ms       <- R3's G0/1 interface
 3      5.533 ms  5.656 ms  6.339 ms
 4   14.180 ms  9.787 ms  7.908 ms

And no massive shocker right here, the second hop within the hint is certainly R3.

Let’s shake issues up just a little bit.

Suppose there was some motive that you simply needed to direct site visitors acquired at router R1 from host H1 destined for H3 to move by R2 . Maybe there was some site visitors evaluation that occurred on that router. Or maybe that hyperlink is extra dependable, even when slower. There are any variety of causes this would possibly come up in a community design. The key half is that you simply don’t need to change ALL forwarding habits, simply a few of it. You have a “policy,” so to talk, that identifies some site visitors you need to alter. This is the place coverage based mostly routing, also known as PBR, is available in.

Policy based mostly routing can appear difficult. To be honest, if overused, it could possibly make networks very difficult and arduous to keep up. However, the technical fundamentals of PBR are fairly easy.

First, you want a approach to determine the site visitors that you simply need to apply the coverage to. Like many “matching” use circumstances in networking, that is typically completed with an access-list. So, right here’s the entry listing that I’ll use to match the site visitors I’m interested by.

ip access-list prolonged H1-to-H3
  10 allow ip host host

This single line prolonged ACL is all that’s wanted. I’m matching all IP site visitors from H1 to H3, however I might be extra particular, to a selected port as properly. Maybe simply net site visitors (tcp/80 & tcp/443) for instance.

Next, a route-map is used to describe the coverage that we need to configure. The “policy” is made up of “match” situations to determine the site visitors and “set” situations to make the “policy based changes” to the site visitors that was matched.

Here is the route-map for my coverage instance.

route-map POLICY-BASED-ROUTING allow 10
  description Traffic from H1 -> H3 route by R2
  match ip tackle H1-to-H3
  set ip next-hop

I’ve used the access-list I created in my “match ip address” command. And, I’ve indicated that when site visitors “matches” this coverage, I need to “set” the next-hop to be

And discover the primary line within the configuration instance. It ends with the quantity “10.” This quantity identifies the place within the route map that this specific coverage entry holds.  A route-map may be made up of many coverage units – every with a “match” and “set” assertion.  In this fashion, community engineers can have very granular management over how site visitors is forwarded within the community.  Pretty useful proper!

Before I’m going a lot farther it’s undoubtedly necessary to notice that route-maps are used for extra than simply coverage based mostly routing.  The route-map assemble can also be used as a part of high quality of service (QoS) configurations, routing protocol filtering, and BGP path manipulations.  So should you discover the configuration choices accessible for match and set one can find a number of different choices.  Most of those are used to be used circumstances apart from coverage based mostly routing.

The final step to finish the configuration of my coverage is to use it to the router interface. Since this coverage is about controlling site visitors from the LAN related to interface Gig0/1 on R1, that’s the place I’ll apply it.

interface Gig0/1.100
  ip coverage route-map POLICY-BASED-ROUTING

That’s it, we’ve configured coverage based mostly routing. Let’s take a look at to see if it’s working.

We’ll begin by rerunning the identical hint route command as earlier than and evaluating the outcomes.

1:~$ traceroute -n

traceroute to (, 30 hops max, 46 byte packets
 1  7.306 ms  3.017 ms  3.337 ms
 2     3.844 ms  4.335 ms  3.688 ms      <- R2's G0/1 interface
 3     7.906 ms  5.125 ms  5.962 ms
 4   8.951 ms  8.912 ms  7.348 ms

Look at that, site visitors is certainly going by R2 now. But let’s confirm that it’s only for site visitors to H3 by hint routing the site visitors to H4.

H1:~$ traceroute -n

traceroute to (, 30 hops max, 46 byte packets
 1  3.681 ms  3.153 ms  2.563 ms
 2     3.613 ms  3.185 ms  3.747 ms     <- R3's G0/1 interface
 3     5.957 ms  7.555 ms  5.040 ms
 4  14.915 ms  7.157 ms  7.853 ms

Yep, site visitors from H1 to H4 is certainly nonetheless following the “standard path” by R3. But what about site visitors from H2 -> H3?  Will it’s redirected by R2?

H2:~$ traceroute -n

traceroute to (, 30 hops max, 46 byte packets
 1  7.284 ms  2.840 ms  3.173 ms
 2     3.526 ms  4.514 ms  3.498 ms    <- R3's G0/1 interface
 3     6.375 ms  7.212 ms  4.900 ms
 4   6.642 ms  6.270 ms  5.884 ms

Nope, solely site visitors from H1 -> H3 is being redirected.

If we have a look at the routing desk on R1, we’ll see nothing has modified.

R1#present ip route   

Routing entry for
  Known by way of "ospf 1", distance 110, metric 3, sort intra space
  Last replace from on GigabitEthernet0/3, 00:23:02 in the past
  Routing Descriptor Blocks:
  *, from, 00:23:02 in the past, by way of GigabitEthernet0/3
      Route metric is 3, site visitors share rely is 1

There are a couple of helpful instructions on the router to examine the standing of coverage based mostly routing.

First up, a fundamental “show” command value noting.

R1#present route-map 

route-map POLICY-BASED-ROUTING, allow, sequence 10
  Match clauses:
    ip tackle (access-lists): H1-to-H3 
  Set clauses:
    ip next-hop
  Policy routing matches: 12 packets, 756 bytes

This command supplies “policy match” statistics. We can see that after I ran this command there have been 12 matches up to now.

Another command that’s helpful is the “debug ip policy” command. It supplies helpful particulars in regards to the processing of the coverage as site visitors flows by the router. But as with every “debug” command, watch out utilizing it on a manufacturing system as it could possibly put a heavy load on community units if there may be numerous site visitors flowing by.

I’ll activate the debugging after which ship a single ICMP (ping) packet from H1 -> H3.

R1#debug ip coverage
Policy routing debugging is on

*Apr 26 00:29:58.282: IP: s= (GigabitEthernet0/1.100), d=, len 84, FIB coverage match
*Apr 26 00:29:58.282: IP: s= (GigabitEthernet0/1.100), d=, len 84, PBR Counted
*Apr 26 00:29:58.282: IP: s= (GigabitEthernet0/1.100), d=, g=, len 84, FIB coverage routed

Compare the above output to the debug output after I ping H1 -> H4.

*Apr 26 00:31:00.294: IP: s= (GigabitEthernet0/1.100), d=, len 84, FIB coverage rejected(no match) - regular forwarding

In the primary instance, “FIB policy match” signifies that the PRB coverage was triggered. And a following debug line reveals that the site visitors was “FIB policy routed.” That’s the PBR in motion. Compare that to the output from the second ping that’s “FIB policy rejected (no match) – normal forwarding.” That output is fairly descriptive.

And with that, we’ve come to the tip of this submit. I hope this brief have a look at coverage based mostly routing helped break it down and introduce you to a brand new know-how device you could put into your toolkit. Maybe it’ll provide help to clear up a enterprise problem sometime. Or perhaps it’ll provide help to in your preparation for the ENARSI examination or different research. Either approach, thanks for hanging out with me right this moment.

 Got a subject you’d like me to breakdown? Let me know within the feedback.



Join the Cisco Learning Network right this moment free of charge.

Follow Cisco Learning & Certifications

Twitter | Facebook | LinkedIn | Instagram | YouTube

Use #CiscoCert to affix the dialog.


Now resides in the United Kingdom and continues to share their insights and experiences with their audience through their YouTube channel and social media presence.

Related Articles


Connect with

Please enter your comment!
Please enter your name here

Latest Articles

error: Content is protected !!