Policy-Based Routing Configuration examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

Restrictions and guidelines· 1

Example: Configuring PBR·· 1

Network configuration· 1

Analysis· 2

Software versions used· 2

Procedure· 2

Verifying the configuration· 3

Configuration files· 3

Example: Configuring IPv6 PBR·· 4

Network configuration· 4

Analysis· 5

Software versions used· 5

Procedure· 5

Verifying the configuration· 6

Configuration files· 6

Related documentation· 7

 

Introduction

The following information provides examples for configuring policy-based routing (PBR) at CLI.

PBR uses user-defined policies to route packets. A policy can specify parameters for packets that match specific criteria such as source address, destination address, IP precedence, and protocol type.

Prerequisites

Procedures and information in the examples might be slightly different depending on the software or hardware version of the products.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of PBR.

Restrictions and guidelines

When configuring the action of redirecting packets to a next hop, you cannot redirect IPv4 packets to an IPv6 address or redirect IPv6 packets to an IPv4 address.

Example: Configuring PBR

Network configuration

As shown in Figure 1, by default, Router A forwards all packets received on GigabitEthernet 1/0/1 destined for the server to next hop 10.4.1.2 according to routing table lookup.

Configure PBR on Router A to forward packets destined for the server as follows:

·     Forward packets received on GigabitEthernet 1/0/1 matching source IP address 10.2.1.1 to next hop 10.5.1.2.

·     Forward TCP packets with port 80 received on GigabitEthernet 1/0/1 to the next hop 10.3.1.2.

Figure 1 Network diagram

 

Analysis

To forward two types of packets to different next hops, configure two ACLs. Use one ACL to match packets sourced from 10.2.1.1 received on GigabitEthernet 1/0/1. Use the other ACL to match TCP packets with port 80 received on GigabitEthernet 1/0/1. In addition, create two PBR policy nodes to redirect the matching packets separately.

Each node is identified by a node number. A smaller node number has a higher priority. To preferentially forward TCP packets (with port 80) received on GigabitEthernet 1/0/1 sourced from 10.2.1.1 to next hop 10.5.1.2, configure a smaller number for the policy node (specify node number 0 in this example).

Software versions used

This example is applicable to low-end, high-end, and core routers of the H3C Comware 7 platform. This document takes version R6749P14 of the H3C MSR3610-X1-DP product as an example. The specific operations might differ by product model and software version.

Procedure

# Assign an IP address to GigabitEthernet 1/0/1.

<RouterA> system-view

[RouterA] interface gigabitethernet 1/0/1

[RouterA-GigabitEthernet1/0/1] ip address 10.1.2.1 255.255.255.0

[RouterA-GigabitEthernet1/0/1] quit

# Assign IP addresses to other interfaces in Figure 1 in the same way. (Details not shown.)

# Configure three static routes with default next hop 10.4.1.2, and make sure all the paths are reachable.

[RouterA] ip route-static 192.168.1.0 24 10.3.1.2

[RouterA] ip route-static 192.168.1.0 24 10.4.1.2 preference 40

[RouterA] ip route-static 192.168.1.0 24 10.5.1.2

# Configure ACL 3005 to match packets sourced from 10.2.1.1.

[RouterA] acl number 3005

[RouterA-acl-adv-3005] rule 0 permit ip source 10.2.1.1 0

[RouterA-acl-adv-3005] quit

# Configure ACL 3006 to match TCP packets with port 80.

[RouterA] acl number 3006

[RouterA-acl-adv-3006] rule 0 permit tcp destination-port eq 80

[RouterA-acl-adv-3006] quit

# Configure Node 0 for policy pbr1 to forward packets matching ACL 3005 to next hop 10.5.1.2.

[RouterA] policy-based-route pbr1 permit node 0

[RouterA-pbr-pbr1-0] if-match acl 3005

[RouterA-pbr-pbr1-0] apply next-hop 10.5.1.2

[RouterA-pbr-pbr1-0] quit

# Configure Node 1 for policy pbr1 to forward packets matching ACL 3006 to next hop 10.3.1.2.

[RouterA] policy-based-route pbr1 permit node 1

[RouterA-pbr-pbr1-1] if-match acl 3006

[RouterA-pbr-pbr1-1] apply next-hop 10.3.1.2

[RouterA-pbr-pbr1-1] quit

# Configure IPv6 interface PBR by applying policy pbr1 to GigabitEthernet 1/0/1 on Router A.

[RouterA] interface gigabitethernet 1/0/1

[RouterA-GigabitEthernet1/0/1] ip policy-based-route pbr1

[RouterA-GigabitEthernet1/0/1] quit

Verifying the configuration

# Execute the display ip policy-based-route command to verify that PBR is successfully configured.

[RouterA] display ip policy-based-route policy pbr1

Policy name: pbr1

  node 0 permit:

    if-match acl 3005

    apply next-hop 10.5.1.2

  node 1 permit:

    if-match acl 3006

    apply next-hop 10.3.1.2

# Use the tracert command to identify following paths (enable sending of ICMP time exceeded messages on intermediate devices, and enable sending of ICMP destination unreachable messages on the destination device):

·     Verify that the TCP packets with port number other than 80 sourced from 10.1.1.1 are forwarded to next hop 10.4.1.2.

<Router> tracert -a 10.1.1.1 192.168.1.1

traceroute to 192.168.1.1 (192.168.1.1) from 10.1.1.1, 30 hops at most, 40 bytes

 each packet, press CTRL_C to break

 1  10.1.2.1 (10.1.2.1)  2.178 ms  1.364 ms  1.058 ms

 2  10.4.1.2 (10.4.1.2)  1.548 ms  1.248 ms  1.112 ms

 3  192.168.1.1 (192.168.1.1)  1.594 ms  1.321 ms  1.093 ms

·     Verify that packets sourced from 10.2.1.1 are forwarded to next hop 10.5.1.2.

<Router> tracert -a 10.2.1.1 192.168.1.1

traceroute to 192.168.1.1 (192.168.1.1) from 10.2.1.1, 30 hops at most, 40 bytes

 each packet, press CTRL_C to break

 1  10.1.2.1 (10.1.2.1)  1.721 ms  1.226 ms  1.050 ms

 2  10.5.1.2 (10.5.1.2)  4.494 ms  1.385 ms  1.170 ms

 3  192.168.1.1 (192.168.1.1)  1.448 ms  1.304 ms  1.093 ms

Configuration files

#

policy-based-route pbr1 permit node 0

 if-match acl 3005

 apply next-hop 10.5.1.2

#

policy-based-route pbr1 permit node 1

 if-match acl 3006

 apply next-hop 10.3.1.2

#

interface GigabitEthernet1/0/1

port link-mode route

 ip address 10.1.2.1 255.255.255.0

 ip policy-based-route pbr1

#

interface GigabitEthernet1/0/2

port link-mode route

 ip address 10.3.1.1 255.255.255.0

#

interface GigabitEthernet1/0/3

port link-mode route

 ip address 10.4.1.1 255.255.255.0

#

interface GigabitEthernet1/0/4

port link-mode route

 ip address 10.5.1.1 255.255.255.0

#

 ip route-static 192.168.1.0 24 10.3.1.2

 ip route-static 192.168.1.0 24 10.4.1.2 preference 40

 ip route-static 192.168.1.0 24 10.5.1.2

#

acl number 3005

 rule 0 permit ip source 10.2.1.1 0

#

acl number 3006

 rule 0 permit tcp destination-port eq 80

#

Example: Configuring IPv6 PBR

Network configuration

As shown in Figure 2, by default, Router A forwards all packets received on GigabitEthernet 1/0/1 destined for the server to next hop 2004:: 2 according to routing table lookup.

Configure IPv6 PBR on Router A to forward packets destined for the server as follows:

·     Forward packets received on GigabitEthernet 1/0/1 matching source IPv6 address 2002::1 to next hop 2005::2.

·     Forward TCP packets with port 80 received on GigabitEthernet 1/0/1 to next hop 2003:: 2.

Figure 2 Network diagram

 

Analysis

To forward two types of packets to different next hops, configure two ACLs. Use one ACL to match packets sourced from 2002:: 1 received on GigabitEthernet 1/0/1. Use the other ACL to match TCP packets with port 80 received on GigabitEthernet 1/0/1. In addition, create two PBR policy nodes to redirect the matching packets separately.

Each node is identified by a node number. A smaller node number has a higher priority. To preferentially forward TCP packets with port 80 received on GigabitEthernet 1/0/1 sourced from 2002::1 to next hop 2005::2, configure a smaller number for the policy node (specify number 0 for this node, and number 1 for the other node).

Software versions used

This example is applicable to low-end, high-end, and core routers of the H3C Comware 7 platform. This document takes version R6749P14 of the H3C MSR3610-X1-DP product as an example. The specific operations might differ by product model and software version.

Procedure

# Assign an IPv6 address to GigabitEthernet 1/0/1.

<RouterA> system-view

[RouterA] interface gigabitethernet 1/0/1

[RouterA-GigabitEthernet1/0/1] ipv6 address 2007::1 64

[RouterA-GigabitEthernet1/0/1] quit

# Assign IPv6 addresses to other interfaces in Figure 2 in the same way. (Details not shown.)

# Configure three IPv6 static route with default next hop 2004::2/64, and make sure all the paths are reachable.

[RouterA] ipv6 route-static 3001:: 64 2003::2

[RouterA] ipv6 route-static 3001:: 64 2004::2 preference 40

[RouterA] ipv6 route-static 3001:: 64 2005::2

# Configure IPv6 ACL 3005 to match packets sourced from 2002::1.

[RouterA] acl ipv6 number 3005

[RouterA-acl6-adv-3005] rule 0 permit ipv6 source 2002::1/128

[RouterA-acl6-adv-3005] quit

# Configure IPv6 ACL 3006 to match TCP packets with port 80 received on GigabitEthernet 1/0/1.

[RouterA] acl ipv6 number 3006

[RouterA-acl6-adv-3006] rule 0 permit tcp destination-port eq 80

[RouterA-acl6-adv-3006] quit

# Configure Node 0 for policy pbr1 to forward packets matching IPv6 ACL 3005 to next hop 2005::2.

[RouterA] ipv6 policy-based-route pbr1 permit node 0

[RouterA-pbr6-pbr1-0] if-match acl 3005

[RouterA-pbr6-pbr1-0] apply next-hop 2005::2

[RouterA-pbr6-pbr1-0] quit

# Configure Node 1 for policy pbr1 to forward packets matching IPv6 ACL 3006 to next hop 2003::2.

[RouterA] ipv6 policy-based-route pbr1 permit node 1

[RouterA-pbr6-pbr1-1] if-match acl 3006

[RouterA-pbr6-pbr1-1] apply next-hop 2003::2

[RouterA-pbr6-pbr1-1] quit

# Configure IPv6 interface PBR by applying policy pbr1 to GigabitEthernet 1/0/1 on Router A.

[RouterA] interface gigabitethernet 1/0/1

[RouterA-GigabitEthernet1/0/1] ipv6 policy-based-route pbr1

[RouterA-GigabitEthernet1/0/1] quit

Verifying the configuration

# Execute the display ipv6 policy-based-route command to verify that IPv6 PBR is successfully configured.

[RouterA] display ipv6 policy-based-route policy pbr1

Policy name: pbr1

  node 0 permit:

    if-match acl 3005

    apply next-hop 2005::2

  node 1 permit:

    if-match acl 3006

    apply next-hop 2003::2

# Verify that Router A forwards received packets sourced from 2002::1 as follows:

·     Forwards packets to IPv6 address 2005::2 when this IPv6 address is reachable.

·     Forwards packets to next hop 2004::2 according to routing table lookup when IPv6 address 2005::2 is unreachable.

# Verify that Router A forwards received TCP packets with port 80 received as follows:

·     Forwards packets to IPv6 address 2003::2 when this IPv6 address is reachable.

·     Forwards packets to next hop 2004::2 according to routing table lookup when IPv6 address 2003::2 is unreachable.

Configuration files

#

ipv6 policy-based-route pbr1 permit node 0

 if-match acl 3005

 apply next-hop 2005::2

#

ipv6 policy-based-route pbr1 permit node 1

 if-match acl 3006

 apply next-hop 2003::2

#

interface GigabitEthernet1/0/1

port link-mode route

 ipv6 policy-based-route pbr1

 ipv6 address 2007::1/64

#

interface GigabitEthernet1/0/2

port link-mode route

 ipv6 address 2003::1 64

#

interface GigabitEthernet1/0/3

port link-mode route

 ipv6 address 2004::1 64

#

interface GigabitEthernet1/0/4

port link-mode route

 ipv6 address 2005::1 64

#

 ipv6 route-static 3001:: 64 2003::2

 ipv6 route-static 3001:: 64 2004::2 preference 40

 ipv6 route-static 3001:: 64 2005::2

#

acl ipv6 number 3005

 rule 0 permit ipv6 source 2002::1/128

#

 acl ipv6 number 3006

 rule 0 permit tcp destination-port eq 80

#

Related documentation

·     Layer 3—IP Routing Configuration Guide in H3C MSR Router Series Comware 7 Configuration Guides

·     Layer 3—IP routing Command Reference in H3C MSR Router Series Comware 7 Command References