Policy-based routing

1. Function Overview

This product provides policy-based routing functionality.

Policy-based routing is a feature that controls the routing of packets (unicast) using various information other than just the destination IP address, unlike conventional IP routing which determines the destination solely based on the destination IP address.
Policy-based routing is an effective technique when multiple communications occur. With normal routing, packets destined for the same network address are forwarded along the same route, which makes it easier for lines to become congested and increases the likelihood of packet loss or delays. Policy-based routing prevents loss or delay of important packets by forwarding them to the optimal route depending on the type of traffic (destination port number).

image

This product can route packets using the following information:

  • Source/destination IPv4 address

  • IP protocol type

  • Source/destination TCP/UDP port number

  • Source/destination MAC address

  • Source IPv6 address

2. Definition of Terms Used

PBR

Abbreviation for Policy-Based Routing.

Access List (ACL)

A list used to control communication access (determining whether to allow or deny frames).

Route Map

A list whose elements (entries) are combinations of conditions specified by an access list and the actions to be executed when the conditions are met.

  • Route Map and Entry Concepts

    image

3. Function Details

PBR is configured by applying a route map to an interface.

The setting procedure for PBR is as follows:

  1. Generate a route map

  2. Register applicable conditions and processing details to the route map

  3. Apply the route map to the interface

The details of each function are described below.

3.1. Generate a route map

Route maps (and entries) are created with the route-map command. The route-map also switches the mode to route map mode at the same time.
In route map mode, you can set the applicable conditions and processing details for each entry.
This product can generate up to 4094 route maps. Also, one route map can have up to 64 entries.

3.2. Setting Applicable Conditions and Processing Details

The conditions to be applied to an entry are set using the match command, and the processing details are set using the set command.
The parameters that can be specified for each command are listed below.

Applicable packet type match set

IPv4 packets

IPv4 access list
MAC access list

IPv4 next-hop (forwarding destination) drop (discard)

IPv6 packets

IPv6 access list

IPv6 next-hop (forwarding destination) drop (discard)

  • When a packet is received and there are multiple entries (conditions) in the access list, all entries are evaluated except for deny entries (deny entries will be ignored).
    If any entry matches, the set operation is executed. If no entries match, the set operation is not executed.

3.3. Applying to the interface

This product allows route maps to be applied only to VLAN interfaces. In addition, two route maps can be applied to one interface: one for IPv4 packets and one for IPv6 packets. Route maps can be applied to IPv4 packets with the ip policy route-map command, and to IPv6 packets with the ipv6 policy route-map command.

Due to hardware resource limitations, there are two limitations on the number of route maps that can be applied to an interface:

  1. Restriction by the number of control conditions for the access list.

  2. Restriction by the number of next-hop

The details of each limitation is described below.

  • Limitation due to the number of control conditions on the access list
    Applying a route map to an interface consumes resources "in proportion to the number of control conditions registered in the access list".
    This product allows you to register up to 6112 control conditions across all interfaces.
    This resource is shared with ACL, VLAN Access Map, Dynamic VLAN, and QoS, so if these are enabled, the applicable number will decrease accordingly.

  • Limitation by number of next hops
    When a route map with a specified next hop is applied to an interface, it consumes resources other than those mentioned above.
    This product can register up to 512 next hops.
    This resource is consumed each time a new next hop is registered, but it is not consumed if the same next hop is already applied on another interface or if a drop is specified.

3.3.1. Resource Consumption Timing

Route maps consume resources not when they are applied to an interface by command, but when the interface and next hop are linked up (or immediately after the command if they are already linked up when they are applied).
Since the command does not consume resources when executed, the command itself will succeed even if there are insufficient resources, but an internal error will be generated (and an error log will be left) when resources are to be actually consumed.
Maintenance personnel must calculate resource consumption and operate accordingly to prevent this error from occurring.

3.4. Routing of Received Packets

When a packet is received on an interface to which a route map is applied, the packet is forwarded according to the settings in the route map.
When an IPv4 packet is received, it follows the route map applied by the ip policy route-map command; when an IPv6 packet is received, it follows the route map applied by the ipv6 policy route-map command.

If a route map has multiple entries, they are processed in sequence number order.
When the applicable conditions are met, the process will be executed and the sequence process will be terminated (ignoring subsequent sequences).

The following shows an example of route map processing.

route-map 1 permit 10
  match A
  set ip next-hop A.B.C.D

route-map 1 permit 20
  match B

route-map 1 permit 30
  set ip next-hop E.F.G.H

route-map 1 deny 40
  match C
  set ip next-hop I.J.K.L

route-map 1 permit 50
  match D
  set interface null

  1. Sequence number 10

    • If condition A is met, forward to next hop A.B.C.D

      • If the next hop is not in the ARP table, forwarding occurs via the normal routing function

  2. Sequence number 20

    • Since there is no set, it is treated as an invalid entry and the setting is ignored (nothing is done).

  3. Sequence number 30

    • Since there is no match, it is treated as an invalid entry and the setting is ignored (nothing is done)

  4. Sequence number 40

    • If condition C is met, the deny entry forwards the packet via the normal routing function

      • Deny entries are ignored even if set exists in the entry

  5. Sequence number 50

    • If condition D is met, discard the packet

  6. Implicit deny

    • The route map contains an implicit deny entry, so all packets are forwarded through the normal routing function.

If a route map applied to IPv4 packets contains entries for IPv6, those entries are considered invalid and ignored. This also applies to the reverse (IPv4 entries in IPv6 packets).

3.5. Enable/Disable PBR Function

The PBR function can be enabled with the pbr enable command and disabled with the pbr disable command.
The PBR function is enabled when shipped from the factory. It can be enabled, that is, restored to the initial state, using the no pbr command.

Even if you disable the PBR function, the PBR-related settings will not be deleted, so you can restore them to their state before they were disabled by enabling them again.

4. Related Commands

Related commands are indicated below.
For details on the commands, refer to the Command Reference.

Operations Operating commands

Generate a route map

route-map

Route map description settings

description

Applicable condition settings for route map entries

match access-list

Processing settings (IPv4 forwarding destination) for route map entries

set ip next-hop

Processing settings (IPv6 forwarding destination) for route map entries

set ipv6 next-hop

Processing settings (packet discard) for route map entries

set interface null

Apply a route map to an interface (for IPv4)

ip policy route-map

Apply a route map to an interface (for IPv6)

ipv6 policy route-map

Enable/disable PBR function

pbr

Show Route Map Information

show route-map

Show IPv4 PBR Information

show ip route pbr

Show IPv6 PBR Information

show ipv6 route pbr

5. Examples of Command Execution

5.1. Apply Route Maps to VLAN Interfaces

5.1.1. IPv4 Next Hop Settings

Configure VLAN #10 to forward packets with destination port number 80 to next hop 192.168.20.2 (all other incoming packets are forwarded via the normal routing function due to the implicit deny entry).
The ID of the access list to use is #1, the ID of the route map is #1000, and the name of the route map is IPV4_NEXTHOP.

image

  1. Configure normal routing.

    Yamaha(config)# ip route 0.0.0.0/0 192.168.20.1 (1)
Yamaha(config)#
    1 Static Route Configuration

  2. Generate access list #1.

    Yamaha(config)#access-list 1 permit tcp any any eq 80 (1)
Yamaha(config)#
    1 Generate access list

  3. Generate route map #1000 and an entry with sequence number #10, then configure* access list #1* and next hop 192.168.20.2.

    Yamaha(config)#route-map 1000 permit 10 (1)
Yamaha(config-route-map)#description IPV4_NEXTHOP (2)
Yamaha(config-route-map)#match access-list 1 (3)
Yamaha(config-route-map)#set ip next-hop 192.168.20.2 (4)
Yamaha(config-route-map)#exit
Yamaha(config)#
    1 Generate route maps and entries
    2 Set a name for the route map
    3 Set applicable conditions
    4 Set the next hop

  4. Apply Route Map #1000 to VLAN #10.

    Yamaha(config)#interface vlan10
Yamaha(config-if)#ip policy route-map 1000 (1)
Yamaha(config-if)#end
Yamaha#
    1 Applying a route map

  5. Check the application status.

    Yamaha#show ip route pbr
Policy Routing
vlan10
  Route Map: 1000, IPV4_NEXTNOP
    10 permit
      match access-list 1
      set ip next-hop 192.168.20.2

5.1.2. IPv6 Next Hop Settings

Configure VLAN #10 to forward packets with source IPv6 address 2000:0:0:10::4/128 to next hop 2000:0:0:20::2 (all other incoming packets are forwarded via the normal routing function due to the implicit deny entry).
The ID of the access list to use is #3001, the ID of the route map is #2000, and the name of the route map is IPV6_NEXTHOP.

image

  1. Configure normal routing.

    Yamaha(config)# ipv6 route ::/0 2000:0:0:20::1 (1)
Yamaha(config)#
    1 Static Route Configuration

  2. Generate access list #3001.

    Yamaha(config)#access-list 3001 permit 2000:0:0:10::4/128 (1)
Yamaha(config)#
    1 Generate access list

  3. Generate route map #2000, and an entry with sequence number #10, then configure access list #3001 and next hop 2000:0:0:20::2.

    Yamaha(config)#route-map 2000 permit 10 (1)
Yamaha(config-route-map)#description IPV6_NEXTHOP (2)
Yamaha(config-route-map)#match access-list 3001 (3)
Yamaha(config-route-map)#set ipv6 next-hop 2000:0:0:20::2 (4)
Yamaha(config-route-map)#exit
Yamaha(config)#
    1 Generate route maps and entries
    2 Set a name for the route map
    3 Set applicable conditions
    4 Set the next hop

  4. Apply route map #2000 to VLAN #10.

    Yamaha(config)#interface vlan10
Yamaha(config-if)#ipv6 policy route-map 2000 (1)
Yamaha(config-if)#end
Yamaha#
    1 Applying a route map

  5. Check the application status.

    Yamaha#show ipv6 route pbr
Policy Routing
vlan10
  Route Map: 2000, IPV6_NEXTHOP
    10 permit
      match access-list 3001
      set ipv6 next-hop 2000:0:0:20::2

5.1.3. Drop Settings

Configure VLAN #10 to forward TCP packets with destination port number 80 to next hop 192.168.20.2, and discard TCP packets with destination port numbers other than 80 (all other incoming packets are forwarded via the normal routing function due to the implicit deny entry).
The IDs of the access lists to use are #2 and #3, the ID of the route map is #3000, and the name of the route map is DROP.
image

  1. Configure normal routing.

    Yamaha(config)# ip route 0.0.0.0/0 192.168.20.1 (1)
Yamaha(config)#
    1 Static Route Configuration

  2. Generate access list #2.

    Yamaha(config)#access-list 2 permit tcp any any eq 80 (1)
Yamaha(config)#
    1 Generate access list

  3. Generate access list #3.

    Yamaha(config)#access-list 3 permit tcp any any (1)
Yamaha(config)#
    1 Generate access list

  4. Generate route map #3000, an entry with sequence number #10, then configure access list #2, and next hop 192.168.20.2.

    Yamaha(config)#route-map 3000 permit 10 (1)
Yamaha(config-route-map)#description DROP (2)
Yamaha(config-route-map)#match access-list 2 (3)
Yamaha(config-route-map)#set next-hop 192.168.20.2 (4)
Yamaha(config-route-map)#exit
Yamaha(config)#
    1 Generate route maps and entries
    2 Set a name for the route map
    3 Set applicable conditions
    4 Set the next hop

  5. Generate an entry with sequence number #20 and set access list #3 and discard.

    Yamaha(config)#route-map 3000 permit 20 (1)
Yamaha(config-route-map)#match access-list 3 (2)
Yamaha(config-route-map)#set interface null (3)
Yamaha(config-route-map)#exit
Yamaha(config)#
    1 Generate an entry
    2 Set applicable conditions
    3 Set discard

  6. Apply route map #3000 to VLAN #10.

    Yamaha(config)#interface vlan10
Yamaha(config-if)#ip policy route-map 3000 (1)
Yamaha(config-if)#end
Yamaha#
    1 Applying a route map

  7. Check the application status.

    Yamaha#show ip route pbr
Policy Routing
vlan10
  Route Map: 3000, DROP
    10 permit
      match access-list 2
      set ip next-hop 192.168.20.2
    20 permit
      match access-list 3
      set interface null

6. Points of Caution

  • PBR only applies to unicast packets. Multicast and broadcast packets are forwarded according to normal routing.

  • PBR cannot be applied to private VLANs and voice VLANs.

  • Due to resource limitations, the PBR function cannot be applied simultaneously with dynamic VLANs. If a dynamic VLAN and PBR are simultaneously configured on the same port, PBR will not function because dynamic VLAN processing takes priority.

  • Conditions might not be determined correctly for fragment packets. Specifically, if layer 4 information (source port number, destination port number, and various TCP flags) is included in the conditions, correct information cannot be determined because the information is not included in the second and subsequent fragment packets. If there is a possibility of processing fragment packets, do not include layer 4 information in the conditions.

  • The PBR function forwards even packets addressed to itself to the next hop if the conditions are met. If you do not want to forward all received packets addressed to you (and you want to process them yourself), add an entry (deny entry) to sequence number 1 of the route map to normally route received packets addressed to you.

7. Related Documentation