Policy-based routing (PBR) uses user-defined policies to route packets. A policy can specify parameters for packets that match specific criteria such as ACLs or that have specific lengths. The parameters include the next hop, output interface, default next hop, and default output interface.

A device forwards received packets using the following process:

1. The device uses PBR to forward matching packets.

2. If the packets do not match the PBR policy or the PBR-based forwarding fails, the device uses the routing table, excluding the default route, to forward the packets.

3. If the routing table-based forwarding fails, the device uses the default next hop or default output interface defined in PBR to forward packets.

4. If the default next hop or default output interface-based forwarding fails, the device uses the default route to forward packets.

PBR includes local PBR and interface PBR.

· Local PBR guides the forwarding of locally generated packets, such as the ICMP packets generated by using the ping command.

· Interface PBR guides the forwarding of packets received on an interface only.

Policy

An IPv6 policy includes match criteria and actions to be taken on the matching packets. A policy can have one or multiple nodes as follows:

· Each node is identified by a node number. A smaller node number has a higher priority.

· A node contains if-match and apply clauses. An if-match clause specifies a match criterion, and an apply clause specifies an action.

· A node has a match mode of permit or deny.

An IPv6 policy compares packets with nodes in priority order. If a packet matches the criteria on a node, it is processed by the action on the node. Otherwise, it goes to the next node for a match. If the packet does not match the criteria on any node, it is forwarded according to the routing table.

if-match clause

IPv6 PBR supports the following types of if-match clauses:

· if-match acl—Sets an ACL match criterion.

· if-match packet-length—Sets a packet length match criterion.

You can specify multiple if-match clauses for a node, but only one if-match clause of each type. A packet that matches all the if-match clauses of a node matches the node.

apply clause

IPv6 PBR supports the types of apply clauses shown in Table 1. You can specify multiple apply clauses for a node, but some of them might not be executed. The following apply clauses determine the packet forwarding paths in a descending order:

· apply access-vpn vpn-instance

· apply remark-vpn

· apply next-hop

· apply output-interface

· apply default-next-hop

· apply default-output-interface

Table 1 Priorities and meanings of apply clauses

Clause	Meaning	Priority
apply precedence	Sets an IP precedence.	This clause is always executed.
apply loadshare { next-hop \| output-interface \| default-next-hop \| default-output-interface }	Enables load sharing among multiple next hops, output interfaces, default next hops, and default output interfaces.	Multiple next hops, output interfaces, default next hops, or default output interfaces operate in either primary/backup or load sharing mode. For example: · Primary/backup mode—The first configured output interface is used. When the primary output interface fails, the first configured backup output interface takes over. · Load sharing mode—Multiple output interfaces load share traffic on a per-packet basis in turn, according to the configuration order. Multiple next hops load share traffic according to their weights. By default, the primary/backup mode applies.
apply access-vpn vpn-instance	Sets VPN instances.	If a packet matches a forwarding entry of a specified VPN instance, it is forwarded in the VPN instance.
apply remark-vpn	Marks the VPN instance for matching packets.	This clause must be used together with the apply access-vpn vpn-instance clause.
apply next-hop and apply output-interface	Sets next hops and sets output interfaces.	Only the apply next-hop clause is executed when both are configured.
apply default-next-hop and apply default-output-interface	Sets default next hops and sets default output interfaces.	Only the apply default-next-hop clause is executed when both are configured. They take effect only when no next hop or output interface is set or the next hop and output interface are invalid, and the IPv6 packet does not match any route in the routing table.
apply continue	Compares packets with the next node upon failure on the current node.	The apply continue clause applies when the apply access-vpn vpn-instance, apply next-hop, apply output-interface, apply default-next-hop, and apply default-output-interface clauses are not configured or become invalid. For example, the specified next hop is unreachable, the specified output interface is down, or the packets cannot be forwarded in the specified VPN instance.

Relationship between the match mode and clauses on the node

Does a packet match all the if-match clauses on the node?	Match mode
Does a packet match all the if-match clauses on the node?	In permit mode	In deny mode
Yes	· If the node is configured with apply clauses, IPv6 PBR executes the apply clauses on the node. ¡ If the IPv6 PBR-based forwarding succeeds, IPv6 PBR does not compare the packet with the next node. ¡ If the IPv6 PBR-based forwarding fails and the apply continue clause is not configured, IPv6 PBR does not compare the packet with the next node. ¡ If the IPv6 PBR-based forwarding fails and the apply continue clause is configured, IPv6 PBR compares the packet with the next node. · If the node is configured with no apply clauses, the packet is forwarded according to the routing table.	The packet is forwarded according to the routing table.
No	IPv6 PBR compares the packet with the next node.	IPv6 PBR compares the packet with the next node.

A node that has no if-match clauses matches any packet.

PBR and Track

PBR can work with the Track feature to dynamically adapt the availability status of an apply clause to the link status of a tracked object. The tracked object can be a next hop, output interface, default next hop, or default output interface.

· When the track entry associated with an object changes to Negative, the apply clause is invalid.

· When the track entry changes to Positive or NotReady, the apply clause is valid.

For more information about Track-PBR collaboration, see High Availability Configuration Guide.

IPv6 PBR configuration task list

Tasks at a glance
(Required.) Configuring an IPv6 policy: · Creating an IPv6 node · Setting match criteria for an IPv6 node · Configuring actions for an IPv6 node
(Required.) Configuring IPv6 PBR: · Configuring IPv6 local PBR · Configuring IPv6 interface PBR

Tasks at a glance

(Required.) Configuring an IPv6 policy:

· Creating an IPv6 node

· Setting match criteria for an IPv6 node

· Configuring actions for an IPv6 node

(Required.) Configuring IPv6 PBR:

· Configuring IPv6 local PBR

· Configuring IPv6 interface PBR

Configuring an IPv6 policy

Creating an IPv6 node

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create an IPv6 policy or policy node and enter its view.	ipv6 policy-based-route policy-name [ deny \| permit ] node node-number	By default, no IPv6 policy nodes exist.

Setting match criteria for an IPv6 node

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter IPv6 policy node view.	ipv6 policy-based-route policy-name [ deny \| permit ] node node-number	N/A
3. Set an ACL match criterion.	if-match acl { ipv6-acl-number \| name ipv6-acl-name }	By default, no ACL match criterion is set. The ACL match criterion cannot match Layer 2 information.
4. Set a packet length match criterion.	if-match packet-length min-len max-len	By default, no packet length match criterion is set.

NOTE:

An ACL match criterion uses the specified ACL to match packets if the action in ACL rules is permit. If the specified ACL does not exist or the action in ACL rules is deny, no packet is matched.

Configuring actions for an IPv6 node

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter IPv6 policy node view.	ipv6 policy-based-route policy-name [ deny \| permit ] node node-number	N/A
3. Set an IP precedence.	apply precedence { type \| value }	By default, no IP precedence is specified.
4. Set VPN instances.	apply access-vpn vpn-instance vpn-instance-name&<1-n>	By default, no VPN instance is specified. You can specify a maximum of n VPN instances for a node. The matching packets are forwarded according to the forwarding table of the first available VPN instance. The value of n is 4.
5. Mark the VPN instance for matching packets.	apply remark-vpn	By default, the VPN instance is not marked for matching packets.
6. Set next hops for permitted IPv6 packets.	apply next-hop [ vpn-instance vpn-instance-name \| inbound-vpn ] { ipv6-address [ direct ] [ track track-entry-number ] [ weight weight-value ] }&<1-n>	By default, no next hop is specified. You can specify multiple next hops for backup or load sharing in one command line or by executing this command multiple times. You can specify a maximum of n next hops for a node. The value of n is 4.
7. Enable load sharing among multiple next hops.	apply loadshare next-hop	By default, the next hops operate in primary/backup mode.
8. Set output interfaces.	apply output-interface { interface-type interface-number [ track track-entry-number ] }&<1-n>	By default, no output interface is specified. You can specify multiple output interfaces for backup or load sharing in one command line or by executing this command multiple times. You can specify a maximum of n output interfaces for a node. The value of n is 4.
9. Enable load sharing among multiple output interfaces.	apply loadshare output-interface	By default, the output interfaces operate in primary/backup mode.
10. Set default next hops.	apply default-next-hop [ vpn-instance vpn-instance-name \| inbound-vpn ] { ipv6-address [ direct ] [ track track-entry-number ] }&<1-n>	By default, no default next hop is specified. You can specify multiple default next hops for backup or load sharing in one command line or by executing this command multiple times. You can specify a maximum of n default next hops for a node. The value of n is 4.
11. Enable load sharing among multiple default next hops.	apply loadshare default-next-hop	By default, the default next hops operate in primary/backup mode.
12. Set default output interfaces.	apply default-output-interface { interface-type interface-number [ track track-entry-number ] }&<1-n>	By default, no default output interface is specified. You can specify multiple default output interfaces for backup or load sharing in one command line or by executing this command multiple times. You can specify a maximum of n default output interfaces for a node. The value of n is 4.
13. Enable load sharing among multiple default output interfaces.	apply loadshare default-output-interface	By default, the default output interfaces operate in primary/backup mode.
14. Compare packets with the next node upon match failure on the current node.	apply continue	By default, IPv6 PBR does not compare packets with the next node upon match failure on the current node. This command takes effect only when the match mode of the node is permit.

Configuring IPv6 PBR

Configuring IPv6 local PBR

Configure IPv6 PBR by applying a policy locally. IPv6 PBR uses the policy to guide the forwarding of locally generated packets. The specified policy must already exist. Otherwise, the IPv6 local PBR configuration fails.

You can apply only one policy locally. Before you apply a new policy, you must first remove the current policy.

IPv6 local PBR might affect local services, such as ping and Telnet. Do not configure IPv6 local PBR unless doing so is required.

To configure IPv6 local PBR:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Apply a policy locally.	ipv6 local policy-based-route policy-name	By default, no policy is locally applied.

Configuring IPv6 interface PBR

Configure IPv6 PBR by applying an IPv6 policy to an interface. IPv6 PBR uses the policy to guide the forwarding of IPv6 packets received on the interface. The specified policy must already exist. Otherwise, the IPv6 interface PBR configuration fails.

You can apply only one policy to an interface. Before you apply a new policy, you must first remove the current policy from the interface.

You can apply a policy to multiple interfaces.

To configure IPv6 interface PBR:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	interface interface-type interface-number	N/A
3. Apply an IPv6 policy to the interface.	ipv6 policy-based-route policy-name	By default, no IPv6 policy is applied to the interface.

Displaying and maintaining IPv6 PBR

Execute display commands in any view and reset commands in user view.

Task	Command
Display IPv6 PBR policy information.	display ipv6 policy-based-route [ policy policy-name ]
Display IPv6 PBR configuration.	display ipv6 policy-based-route setup
Display IPv6 local PBR configuration and statistics (in standalone mode).	display ipv6 policy-based-route local [ slot slot-number ]
Display IPv6 local PBR configuration and statistics (in IRF mode).	display ipv6 policy-based-route local [ chassis chassis-number slot slot-number ]
Display IPv6 interface PBR configuration and statistics (in standalone mode).	display ipv6 policy-based-route interface interface-type interface-number [ slot slot-number ]
Display IPv6 interface PBR configuration and statistics (in IRF mode).	display ipv6 policy-based-route interface interface-type interface-number [ chassis chassis-number slot slot-number ]
Clear IPv6 PBR statistics.	reset ipv6 policy-based-route statistics [ policy policy-name ]

IPv6 PBR configuration examples

Packet type-based IPv6 local PBR configuration example

Network requirements

As shown in Figure 1, configure IPv6 PBR on Router A to forward all TCP packets to the next hop 1::2. Router A forwards other packets according to the routing table.

Figure 1 Network diagram

Configuration procedure

1. Configure Router A:

# Configure the IPv6 addresses of GigabitEthernet 1/1/1 and GigabitEthernet 1/1/2.

<RouterA> system-view

[RouterA] interface gigabitethernet 1/1/1

[RouterA-GigabitEthernet1/1/1] ipv6 address 1::1 64

[RouterA-GigabitEthernet1/1/1] quit

[RouterA] interface gigabitethernet 1/1/2

[RouterA-GigabitEthernet1/1/2] ipv6 address 2::1 64

[RouterA-GigabitEthernet1/1/2] quit

# Configure ACL 3001 to match TCP packets.

[RouterA] acl ipv6 advanced 3001

[RouterA-acl-ipv6-adv-3001] rule permit tcp

[RouterA-acl-ipv6-adv-3001] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1::2.

[RouterA] ipv6 policy-based-route aaa permit node 5

[RouterA-pbr6-aaa-5] if-match acl 3001

[RouterA-pbr6-aaa-5] apply next-hop 1::2

[RouterA-pbr6-aaa-5] quit

# Configure IPv6 local PBR by applying policy aaa to Router A.

[RouterA] ipv6 local policy-based-route aaa

2. On Router B, configure the IPv6 address of GigabitEthernet 1/1/1.

<RouterB> system-view

[RouterB] interface gigabitethernet 1/1/1

[RouterB-GigabitEthernet1/1/1] ipv6 address 1::2 64

3. On Router C, configure the IPv6 address of GigabitEthernet 1/1/2.

<RouterC> system-view

[RouterC] interface gigabitethernet 1/1/2

[RouterC-GigabitEthernet1/1/2] ipv6 address 2::2 64

Verifying the configuration

# Telnet to Router B on Router A. The operation succeeds.

# Telnet to Router C on Router A. The operation fails.

# Ping Router C from Router A. The operation succeeds.

Telnet uses TCP, and ping uses ICMP. The results show the following:

· All TCP packets sent from Router A are forwarded to the next hop 1::2.

· Other packets are forwarded through GigabitEthernet 1/1/2.

· The IPv6 local PBR configuration is effective.

Packet type-based IPv6 interface PBR configuration example

Network requirements

As shown in Figure 2, configure IPv6 PBR on Router A to forward all TCP packets received on GigabitEthernet 1/1/1 to the next hop 1::2. Router A forwards other IPv6 packets according to the routing table.

Figure 2 Network diagram

Configuration procedure

1. Configure Router A:

# Configure RIPng.

<RouterA> system-view

[RouterA] ripng 1

[RouterA-ripng-1] quit

[RouterA] interface gigabitethernet 1/1/2

[RouterA-GigabitEthernet1/1/2] ipv6 address 1::1 64

[RouterA-GigabitEthernet1/1/2] ripng 1 enable

[RouterA-GigabitEthernet1/1/2] quit

[RouterA] interface gigabitethernet 1/1/3

[RouterA-GigabitEthernet1/1/3] ipv6 address 2::1 64

[RouterA-GigabitEthernet1/1/3] ripng 1 enable

[RouterA-GigabitEthernet1/1/3] quit

# Configure ACL 3001 to match TCP packets.

[RouterA] acl ipv6 advanced 3001

[RouterA-acl-ipv6-adv-3001] rule permit tcp

[RouterA-acl-ipv6-adv-3001] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1::2.

[RouterA] ipv6 policy-based-route aaa permit node 5

[RouterA-pbr6-aaa-5] if-match acl 3001

[RouterA-pbr6-aaa-5] apply next-hop 1::2

[RouterA-pbr6-aaa-5] quit

# Configure IPv6 interface PBR by applying policy aaa to GigabitEthernet 1/1/1.

[RouterA] interface gigabitethernet 1/1/1

[RouterA-GigabitEthernet1/1/1] ipv6 address 10::2 64

[RouterA-GigabitEthernet1/1/1] undo ipv6 nd ra halt

[RouterA-GigabitEthernet1/1/1] ripng 1 enable

[RouterA-GigabitEthernet1/1/1] ipv6 policy-based-route aaa

[RouterA-GigabitEthernet1/1/1] quit

2. Configure RIPng on Router B.

<RouterB> system-view

[RouterB] ripng 1

[RouterB-ripng-1] quit

[RouterB] interface gigabitethernet 1/1/2

[RouterB-GigabitEthernet1/1/2] ipv6 address 1::2 64

[RouterB-GigabitEthernet1/1/2] ripng 1 enable

[RouterB-GigabitEthernet1/1/2] quit

3. Configure RIPng on Router C.

<RouterC> system-view

[RouterC] ripng 1

[RouterC-ripng-1] quit

[RouterC] interface gigabitethernet 1/1/3

[RouterC-GigabitEthernet1/1/3] ipv6 address 2::2 64

[RouterC-GigabitEthernet1/1/3] ripng 1 enable

[RouterC-GigabitEthernet1/1/3] quit

Verifying the configuration

# Enable IPv6 and configure the IPv6 address 10::3 for Host A.

C:\>ipv6 install

Installing...

Succeeded.

C:\>ipv6 adu 4/10::3

# On Host A, Telnet to Router B that is directly connected to Router A. The operation succeeds.

# On Host A, Telnet to Router C that is directly connected to Router A. The operation fails.

# Ping Router C from Host A. The operation succeeds.

Telnet uses TCP, and ping uses ICMP. The results show the following:

· All TCP packets arriving on GigabitEthernet 1/1/1 of Router A are forwarded to the next hop 1::2.

· Other packets are forwarded through GigabitEthernet 1/1/3.

· The IPv6 interface PBR configuration is effective.

Packet length-based IPv6 interface PBR configuration example

Network requirements

As shown in Figure 3, configure IPv6 interface PBR to guide the forwarding of packets received on GigabitEthernet 1/1/1 of Router A as follows:

· Set the next hop of packets with a length of 64 to 100 bytes to 150::2/64.

· Set the next hop of packets with a length of 101 to 1000 bytes to 151::2/64.

Router A forwards other packets according to the routing table.

Figure 3 Network diagram

Configuration procedure

1. Configure Router A:

# Configure RIPng.

<RouterA> system-view

[RouterA] ripng 1

[RouterA-ripng-1] quit

[RouterA] interface gigabitethernet 1/1/2

[RouterA-GigabitEthernet1/1/2] ipv6 address 150::1 64

[RouterA-GigabitEthernet1/1/2] ripng 1 enable

[RouterA-GigabitEthernet1/1/2] quit

[RouterA] interface gigabitethernet 1/1/3

[RouterA-GigabitEthernet1/1/3] ipv6 address 151::1 64

[RouterA-GigabitEthernet1/1/3] ripng 1 enable

[RouterA-GigabitEthernet1/1/3] quit

# Configure Node 10 for policy lab1 to forward packets with a length of 64 to 100 bytes to the next hop 150::2/64.

[RouterA] ipv6 policy-based-route lab1 permit node 10

[RouterA-pbr6-lab1-10] if-match packet-length 64 100

[RouterA-pbr6-lab1-10] apply next-hop 150::2

[RouterA-pbr6-lab1-10] quit

# Configure Node 20 for policy lab1 to forward packets with a length of 101 to 1000 bytes to the next hop 151::2/64.

[RouterA] ipv6 policy-based-route lab1 permit node 20

[RouterA-pbr6-lab1-20] if-match packet-length 101 1000

[RouterA-pbr6-lab1-20] apply next-hop 151::2

[RouterA-pbr6-lab1-20] quit

# Configure IPv6 interface PBR by applying policy lab1 to GigabitEthernet 1/1/1.

[RouterA] interface gigabitethernet 1/1/1

[RouterA-GigabitEthernet1/1/1] ipv6 address 192::1 64

[RouterA-GigabitEthernet1/1/1] undo ipv6 nd ra halt

[RouterA-GigabitEthernet1/1/1] ripng 1 enable

[RouterA-GigabitEthernet1/1/1] ipv6 policy-based-route lab1

[RouterA-GigabitEthernet1/1/1] return

2. Configure RIPng on Router B.

<RouterB> system-view

[RouterB] ripng 1

[RouterB-ripng-1] quit

[RouterB] interface gigabitethernet 1/1/2

[RouterB-GigabitEthernet1/1/2] ipv6 address 150::2 64

[RouterB-GigabitEthernet1/1/2] ripng 1 enable

[RouterB-GigabitEthernet1/1/2] quit

[RouterB] interface gigabitethernet 1/1/3

[RouterB-GigabitEthernet1/1/3] ipv6 address 151::2 64

[RouterB-GigabitEthernet1/1/3] ripng 1 enable

[RouterB-GigabitEthernet1/1/3] quit

[RouterB] interface loopback 0

[RouterB-LoopBack0] ipv6 address 10::1 128

[RouterB-LoopBack0] ripng 1 enable

Verifying the configuration

# Execute the debugging ipv6 policy-based-route command on Router A.

<RouterA> debugging ipv6 policy-based-route

<RouterA> terminal logging level 7

<RouterA> terminal monitor

# Install IPv6 protocol suites on Host A, and configure the IPv6 address 192::3.

C:\>ipv6 install

Installing...

Succeeded.

C:\>ipv6 adu 4/192::3

# Ping Loopback 0 of Router B from Host A, and set the data length to 64 bytes.

C:\>ping –n 1 -l 64 10::1

Pinging 10::1 with 64 bytes of data:

Reply from 10::1: time=1ms

Ping statistics for 10::1:

Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 1ms, Maximum = 1ms, Average = 1ms

The debugging information about IPv6 PBR displayed on Router A is as follows:

*Jun 26 13:04:33:519 2012 RouterA PBR6/7/PBR Forward Info: -MDC=1; Policy:lab1, Node:

10,match succeeded.

*Jun 26 13:04:33:519 2012 RouterA PBR6/7/PBR Forward Info: -MDC=1; apply next-hop 150

::2.

The output shows that Router A sets the next hop for the received packets to 150::2 according to IPv6 PBR. The packets are forwarded through GigabitEthernet 1/1/2.

# Ping Loopback 0 of Router B from Host A, and set the data length to 200 bytes.

C:\>ping –n 1 -l 200 10::1

Pinging 10::1 with 200 bytes of data:

Reply from 10::1: time=1ms

Ping statistics for 10::1:

Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 1ms, Maximum = 1ms, Average = 1ms

The debugging information about IPv6 PBR displayed on Router A is as follows:

*Jun 26 13:20:33:619 2012 RouterA PBR6/7/PBR Forward Info: -MDC=1; Policy:lab1, Node:

20,match succeeded.

*Jun 26 13:20:33:619 2012 RouterA PBR6/7/PBR Forward Info: -MDC=1; apply next-hop 151

::2.

The output shows that Router A sets the next hop for the received packets to 151::2 according to IPv6 PBR. The packets are forwarded through GigabitEthernet 1/1/3.

07-Layer 3 - IP Routing Configuration Guide

Configuring IPv6 PBR

if-match clause

apply clause

Relationship between the match mode and clauses on the node

Configuring an IPv6 policy

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Packet length-based IPv6 interface PBR configuration example

Network requirements

Configuration procedure

Verifying the configuration

Cloud & AI

InterConnect

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Resources

Partner Business Management

Company Information

News & Events

Contact Us