What is policy-based routing, and how do you configure it on IOS?
Show the answer
Say this first
PBR forwards packets based on something other than the destination: source address, protocol, ports, DSCP.
You match traffic with an ACL in a route-map, set a next hop, and apply the route-map inbound on the
interface where the traffic arrives. Traffic that does not match, or hits a deny, is routed normally. Use
set ip next-hop verify-availability with tracking so PBR stops using a next hop that is dead.
Go deeper
Send guest traffic to the second ISP
ip access-list extended GUEST-TRAFFIC
permit ip 10.50.0.0 0.0.0.255 any
!
ip sla 2
icmp-echo 198.51.100.1 source-interface GigabitEthernet0/0/3
frequency 5
ip sla schedule 2 life forever start-time now
track 2 ip sla 2 reachability
!
route-map PBR-GUEST permit 10
match ip address GUEST-TRAFFIC
set ip next-hop verify-availability 198.51.100.1 1 track 2
!
interface GigabitEthernet0/0/1.50
ip policy route-map PBR-GUESTBehaviour to know
- Applied inbound. Traffic the router itself generates needs
ip local policy route-map. set ip next-hopis used before the routing table.set ip default next-hopis used only if the routing table has no explicit route for the destination; a default route does not count as explicit.- Without tracking, PBR keeps using a next hop as long as it looks reachable on a connected link, even if the path beyond it is dead.
- The return traffic follows normal routing on the far side, so paths are often asymmetric.
Verifying
show route-map PBR-GUEST shows a Policy routing matches packet counter. show ip policy lists which
interfaces have a policy. debug ip policy shows match decisions, so use it with care on a busy router.
They will ask next
What else does the guest-to-ISP2 design need?
NAT to ISP2's address. With two ISPs, use one NAT rule per ISP with a route-map that matches the outgoing interface, so each flow is translated to the address of the link it actually leaves on.
Is PBR done in hardware?
On Catalyst switches and most hardware routers, yes, programmed into TCAM. Some actions or very large ACLs fall back to software, so check the platform limits before relying on PBR at line rate.
Traps
- Applying the policy outbound or on the wrong interface. It goes where the traffic enters.
- Testing with a ping from the router itself. Router-generated traffic is not policy routed by an interface policy.