How does a route-map work? Explain the match and set logic.
Show the answer
Say this first
A route-map is an ordered list of numbered entries, each permit or deny, with match conditions and set actions. The router checks entries from the lowest sequence number, and the first entry that matches decides: permit applies its sets and selects the item, deny rejects it. Nothing matched means an implicit deny at the end. An entry with no match clause matches everything. Several values on one match line are OR; separate match lines are AND.
Go deeper
Example: redistribute only LAN subnets, tagged, as E1
ip prefix-list LAN-NETS seq 5 permit 10.10.0.0/16 le 24
!
route-map CONNECTED-TO-OSPF permit 10
match ip address prefix-list LAN-NETS
set metric 50
set metric-type type-1
set tag 500
route-map CONNECTED-TO-OSPF deny 20
!
router ospf 1
redistribute connected subnets route-map CONNECTED-TO-OSPFThe deny 20 entry only repeats the implicit deny, but it makes the intent obvious to the next engineer.
The rules people get wrong
| Rule | Example |
|---|---|
| Same match command, several values: OR | match ip address prefix-list A B matches A or B |
| Different match commands: AND | match tag 500 plus match ip address prefix-list A needs both |
| A deny inside the ACL or prefix-list means "no match", not "drop" | the item falls through to the next sequence |
deny entry means "not selected" | not redistributed, not advertised, routed normally in PBR |
| First match wins | later entries are not checked, except with continue in BGP |
Where route-maps are used
Redistribution, BGP neighbor policy in and out, policy-based routing, conditional default origination, NAT with several ISPs, and inbound distribute-lists in OSPF.
They will ask next
An ACL in a permit route-map entry has a deny line that matches a route. What happens to the route?
The entry does not match, so the route moves on to the next sequence. If no later entry matches, the implicit deny at the end rejects it.
Traps
- Forgetting the implicit deny. A route-map with only a deny entry rejects everything.
- Reading
denyin a PBR route-map as dropping traffic. It means "do not policy route; use the routing table".