Table of Contents

Chapter 1 Routing Policy Configuration. 1-1

1.1 Introduction to Routing Policy. 1-1

1.1.1 Routing Policy. 1-1

1.1.2 Filters. 1-2

1.1.3 Routing Policy Application. 1-3

1.2 Routing Policy Configuration Task List 1-3

1.3 Defining Filtering Lists. 1-4

1.3.1 Prerequisites. 1-4

1.3.2 Defining an IP-prefix List 1-4

1.3.3 Defining an AS Path ACL. 1-5

1.3.4 Defining a Community List 1-6

1.3.5 Defining an Extended Community List 1-6

1.4 Configuring a Routing Policy. 1-7

1.4.1 Prerequisites. 1-7

1.4.2 Creating a Routing Policy. 1-7

1.4.3 Defining if-match Clauses for the Routing Policy. 1-8

1.4.4 Defining apply Clauses for the Routing Policy. 1-10

1.5 Displaying and Maintaining the Routing Policy. 1-12

1.6 Routing Policy Configuration Examples. 1-12

1.6.1 Applying Routing Policy When Redistributing IPv4 Routes. 1-12

1.6.2 Applying Routing Policy When Redistributing IPv6 Routes. 1-16

1.7 Troubleshooting Routing Policy Configuration. 1-17

1.7.1 IPv4 Routing Information Filtering Failure. 1-17

1.7.2 IPv6 Routing Information Filtering Failure. 1-18

 

Chapter 1  Routing Policy Configuration

A routing policy is used on a router for route inspection, filtering, attributes modifying when routes are received, advertised, or redistributed.

When configuring routing policy, go to these sections for information you are interested in:

l           Introduction to Routing Policy

l           Routing Policy Configuration Task List

l           Defining Filtering Lists

l           Configuring a Routing Policy

l           Displaying and Maintaining the Routing Policy

l           Routing Policy Configuration Example

l           Troubleshooting Routing Policy Configuration

 

 

1.1  Introduction to Routing Policy

1.1.1  Routing Policy

A routing policy is used on the router for route inspection, filtering, attributes modifying when routes are received, advertised, or redistributed.

When distributing or receiving routing information, a router can apply a policy to filter routing information. For example, a router handles only routing information that matches some criteria of a routing policy; a routing protocol redistributes from another protocol only routes matching some criteria of a routing policy and modifies some attributes of these routes to satisfy its needs according to the routing policy.

To implement a routing policy, you need define a set of match criteria according to attributes in routing information, such as destination address, advertising router’s address and so on. The match criteria can be set beforehand and then apply them to a routing policy for route distribution, reception and redistribution.

1.1.2  Filters

Routing protocols can use six filters: ACL, IP prefix list, AS path ACL, community list, extended community list and routing policy.

I. ACL

ACL involves IPv4 ACL and IPv6 ACL. When defining an ACL, you can specify IP addresses and prefixes to match destinations or next hops of routing information.

For ACL configuration, refer to ACL Configuration.

II. IP prefix list

IP prefix list involves IPv4 and IPv6 prefix list.

IP prefix list plays a role similar to ACL, but it is more flexible than ACL and easier to understand. When an IP prefix list is applied to filtering routing information, its matching object is the destination address of routing information. Moreover, you can specify the gateway option to indicate that only routing information advertised by certain routers will be received. For gateway option information, refer to RIP Commands and OSPF Commands.

An IP prefix list is identified by name. Each IP prefix list can comprise multiple items, and each item, which is identified by an index number, can specify a matching range in network prefix format. The index number indicates the matching sequence of items in the IP prefix list.

During matching, the router compares the packet with the items in the ascending order. If one item is matched, the IP prefix list filter is passed, and the packet will not go to the next item.

III. AS-path list

AS path list is only applicable to BGP. There is an AS-path field in the BGP packet. An AS path list specifies matching conditions according to the AS-path field.

IV. Community list

Community list only applies to BGP. The BGP packet contains a community attribute field to identify a community. A community list specifies matching conditions based on the community attribute.

V. Extended community list

Extended community list (extcommunity-list) applies to BGP only. It involves two attributes: Route-Target extcommunity for VPN, Source of Origin extcommunity. An extcommunity-list specifies matching conditions according to the two attributes.

The Source of Origin extcommunity attribute, which is the application in the source routing feature, is not supported currently.

VI. Routing policy

A routing policy is used to match against some attributes in given routing information and modify the attributes of the information if match conditions are satisfied. It can reference the above mentioned filters to define its own match criteria.

A routing policy can comprise multiple nodes, which are in logic OR relationship. Each node is a match unit, and the system compares each node to a packet in the order of node sequence number. Once a node is matched, the routing policy is passed and the packet will not go through the next node.

Each node comprises a list of if-match and apply clauses. The if-match clauses define the match criteria. The matching objects are some attributes of routing information. The different if-match clauses on a node is in logical AND relationship. Only when the matching conditions specified by all the if-match clauses on the node are satisfied, can routing information pass the node. The apply clauses specify the actions performed after the node is passed, concerning the attribute settings for routing information.

1.1.3  Routing Policy Application

A routing policy is applied in two ways:

l           When redistributing routes from other routing protocols, a routing protocol accepts only routes passing the routing policy.

l           When receiving or advertising routing information, a routing protocol uses the routing policy to filter routing information.

1.2  Routing Policy Configuration Task List

Complete the following tasks to configure a routing policy:

Task
Defining Filtering Lists	Defining an IP-prefix List
	Defining an AS Path ACL
	Defining a Community List
	Defining an Extended Community List
Configuring a Routing Policy	Creating a Routing Policy
	Defining if-match Clauses for the Routing Policy
	Defining apply Clauses for the Routing Policy

 

1.3  Defining Filtering Lists

1.3.1  Prerequisites

Before configuring this task, you need to decide on:

l           IP-prefix list name

l           Matching address range

l           Extcommunity list sequence number

1.3.2  Defining an IP-prefix List

I. Define an IPv4 prefix list

Identified by name, each IPv4 prefix list can comprise multiple items. Each item specifies a matching address range in the form of network prefix identified by index number.

During matching, the system compares the route to each item identified by index number in the ascending order. If one item matches, the route passes the IP-prefix list, without needing to match against the next item.

Follow these steps to define an IPv4 prefix list:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Define an IPv4 prefix list	ip ip-prefix ip-prefix-name [ index index-number ] { permit | deny } ip-address mask-length [ greater-equal min-mask-length ] [ less-equal max-mask-length ]	Required Not defined by default

 

 

For example, the following configuration filters routes 10.1.0.0/16, 10.2.0.0/16 and 10.3.0.0/16, but allows other routes to pass.

<Sysname> system-view

[Sysname] ip ipv6-prefix abc index 10 deny 10.1.0.0 16

[Sysname] ip ipv6-prefix abc index 20 deny 10.2.0.0 16

[Sysname] ip ipv6-prefix abc index 30 deny 10.3.0.0 16

[Sysname] ip ipv6-prefix abc index 40 permit 0.0.0.0 0 less-equal 32

II. Define an IPv6 prefix list

Identified by name, each IPv6 prefix list can comprise multiple items. Each item specifies a matching address range in the form of network prefix, which is identified by index number.

During matching, the system compares the route to each item in the ascending order of index number. If one item is matched, the route passes the IP-prefix list, without needing to match the next item.

Follow these steps to define an IPv6 prefix list:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Define an IPv6 prefix list	ip ipv6-prefix ipv6-prefix-name [ index index-number ] { deny | permit } ipv6-address prefix-length [ greater-equal min-prefix-length ] [ less-equal max-prefix-length ]	Required Not defined by default

 

 

For example, the following configuration filters routes 2000:1::/48, 2000:2::/48 and 2000:3::/48, but allows other routes to pass.

<Sysname> system-view

[Sysname] ip ip-prefix abc index 10 deny 2000:1:: 48

[Sysname] ip ip-prefix abc index 20 deny 2000:2:: 48

[Sysname] ip ip-prefix abc index 30 deny 2000:3:: 16

[Sysname] ip ip-prefix abc index 40 permit :: 0 less-equal 128

1.3.3  Defining an AS Path ACL

You can define multiple items for an AS path ACL that is identified by number. During matching, the relation between items is logical OR, that is, if the route matches one of these items, it passes the AS path ACL.

Follow these steps to define an AS path ACL:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Define an AS path ACL	ip as-path as-path-number { deny | permit } regular-expression	Required Not defined by default

 

1.3.4  Defining a Community List

You can define multiple items for a community list that is identified by number. During matching, the relation between items is logic OR, that is, if routing information matches one of these items, it passes the community list.

Follow these steps to define a community list:

To do…		Use the command…	Remarks
Enter system view		system-view	—
Define a community list	Define a basic community list	ip community-list basic-comm-list-num { deny | permit } [ community-number-list ] [ internet | no-advertise | no-export | no-export-subconfed ] *	Required to define either
	Define an advanced community list	ip community-list adv-comm-list-num { deny | permit } regular-expression

 

1.3.5  Defining an Extended Community List

You can define multiple items for an extended community list that is identified by number. During matching, the relation between items is logic OR, that is, if routing information matches one of these items, it passes the extended community list.

Follow these steps to define an extended community list:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Define an extended community list	ip extcommunity-list ext-comm-list-number { deny | permit } { rt { as-number:nn | ip-address:nn } }&<1-16>	Required Not defined by default

 

1.4  Configuring a Routing Policy

A routing policy is used to filter routing information according to some attributes, and modify some attributes of the routing information that matches the routing policy. Match criteria can be configured using filters above mentioned.

A routing policy can comprise multiple nodes, each node contains:

l           if-match clauses: Define the match criteria that routing information must satisfy. The matching objects are some attributes of routing information.

l           apply clauses: Specify the actions performed after specified match criteria are satisfied, concerning attribute settings for passed routing information.

1.4.1  Prerequisites

Before configuring this task, you have completed:

l           Filtering list configuration

l           Routing protocol configuration

You also need to decide on:

l           Name of the routing policy, node sequence numbers

l           Match criteria

l           Attributes to be modified

1.4.2  Creating a Routing Policy

Follow these steps to create a routing policy:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Create a routing policy and enter its view	route-policy route-policy-name { permit | deny } node node-number	Required

 

 

1.4.3  Defining if-match Clauses for the Routing Policy

Follow these steps to define if-match clauses for a route-policy:

To do…		Use the command…	Remarks
Enter system view		system-view	—
Enter routing policy view		route-policy route-policy-name { permit | deny } node node-number	Required
Define match criteria for IPv4 routes	Match IPv4 routes having destinations specified in the ACL	if-match acl acl-number	Optional Not configured by default
	Match IPv4 routes having destinations specified in the IP prefix list	if-match ip-prefix ip-prefix-name
	Match IPv4 routes having next hops or sources specified in the ACL or IP prefix list	if-match ip { next-hop | route-source } { acl acl-number | ip-prefix ip-prefix-name }	Optional Not configured by default
Match IPv6 routes having the next hop or source specified in the ACL or IP prefix list		if-match ipv6 { address | next-hop | route-source } { acl acl-number | prefix-list ipv6-prefix-name }	Optional Not configured by default
Match routes having AS path attributes specified in the AS path ACL(s)		if-match as-path as-path-number&<1-16>	Optional Not configured by default
Match routes having community attributes in the specified community list(s)		if-match community { basic-community-list-number [ whole-match ] | adv-community-list-number }&<1-16>	Optional Not configured by default
Match routes having the specified cost		if-match cost value	Optional Not configured by default
Match BGP routes having extended attributes contained in the extended community list(s)		if-match extcommunity ext-comm-list-number&<1-16>	Optional Not configured by default
Match routes having specified outbound interface(s)		if-match interface { interface-type interface-number }&<1-16>	Optional Not configured by default
Match routes having MPLS label		if-match mpls-label	Optional Not configured by default
Match routes having the specified route type		if-match route-type { internal | external-type1 | external-type2 | external-type1or2 | is-is-level-1 | is-is-level-2 | nssa-external-type1 | nssa-external-type2 | nssa-external-type1or2 } *	Optional Not configured by default
Match RIP, OSPF, or IS-IS routes having the specified tag value		if-match tag value	Optional Not configured by default

 

 

1.4.4  Defining apply Clauses for the Routing Policy

Follow these steps to define apply clauses for a route-policy:

To do…		Use the command…	Remarks
Enter system view		system-view	—
Create a routing policy and enter its view		route-policy route-policy-name { permit | deny } node node-number	Required Not created by default
Set AS_Path attribute for BGP routes		apply as-path as-number&<1-10> [ replace ]	Optional Not set by default
Specify a community list according to which to delete community attributes of BGP routing information		apply comm-list comm-list-number delete	Optional Not configured by default
Set community attribute for BGP routes		apply community { none | additive | { community-number&<1-16> | aa:nn&<1-16> | internet | no-export-subconfed | no-export | no-advertise } * [ additive ] }	Optional Not set by default
Set a cost for routes		apply cost [ + | - ] value	Optional Not set by default
Set a cost type for routes		apply cost-type [ external | internal | type-1 | type-2 ]	Optional Not set by default
Set the extended community attribute for BGP routes		apply extcommunity { rt { as-number:nn | ip-address:nn } }&<1-16> [ additive ]	Optional Not set by default
Set a next hop	for IPv4 routes	apply ip-address next-hop ip-address	Optional Not set by default The next hop set using the apply ip-address next-hop command does not take effect for route redistribution.
	for IPv6 routes	apply ipv6 next-hop ipv6-address	Optional Not set by default The next hop set using the apply ip-address next-hop command does not take effect for route redistribution.
Redistribute routes to a specified ISIS level		apply isis { level-1 | level-1-2 | level-2 }	Optional Not configured by default
Set a local preference for BGP routes		apply local-preference preference	Optional Not set by default
Set MPLS label		apply mpls-label	Optional Not set by default
Set an origin attribute for BGP routes		apply origin { igp | egp as-number | incomplete }	Optional Not set by default
Set a preference for the matched routing protocol		apply preference preference	Optional Not set by default
Set a preferred value for BGP routes		apply preferred-value preferred-value	Optional Not set by default
Set a tag value for RIP, OSPF or IS-IS routes		apply tag value	Optional Not set by default

 

 

1.5  Displaying and Maintaining the Routing Policy

To do…	Use the command…	Remarks
Display BGP AS path ACL information	display ip as-path [ as-path-number ]	Available in any view
Display BGP community list information	display ip community-list [ basic-community-list-number | adv-community-list-number ]
Display BGP extended community list information	display ip extcommunity-list [ ext-comm-list-number ]
Display IPv4 prefix list statistics	display ip ip-prefix [ ip-prefix-name ]
Display routing policy information	display route-policy [ route-policy-name ]
Clear IPv4 prefix list statistics	reset ip ip-prefix [ ip-prefix-name ]	Available in user view
Clear IPv6 prefix statistics	reset ip ipv6-prefix [ ipv6-prefix-name ]

 

1.6  Routing Policy Configuration Examples

1.6.1  Applying Routing Policy When Redistributing IPv4 Routes

I. Network Requirements

l           Switch B exchanges routing information with Switch A via OSPF, with Switch C via IS-IS.

l           On Switch B, configure route redistribution from IS-IS to OSPF and apply a routing policy to set attributes of redistributed routes, setting the cost of route 172.17.1.0/24 to 100, tag of route 172.17.2.0/24 to 20.

II. Network diagram

Figure 1-1 Network diagram for routing policy application to route redistribution

III. Configuration procedure

1)         Specify IP addresses for interfaces (omitted).

2)         Configure IS-IS

# Configure Switch C.

<SwitchC> system-view

[SwitchC] isis

[SwitchC-isis-1] is-level level-2

[SwitchC-isis-1] network-entity 10.0000.0000.0001.00

[SwitchC-isis-1] quit

[SwitchC] interface vlan-interface 200

[SwitchC-Vlan-interface200] isis enable

[SwitchC-Vlan-interface200] quit

[SwitchC] interface vlan-interface 201

[SwitchC-Vlan-interface201] isis enable

[SwitchC-Vlan-interface201] quit

[SwitchC] interface vlan-interface 202

[SwitchC-Vlan-interface202] isis enable

[SwitchC-Vlan-interface202] quit

[SwitchC] interface vlan-interface 203

[SwitchC-Vlan-interface203] isis enable

[SwitchC-Vlan-interface203] quit

# Configure Switch B.

<SwitchB> system-view

[SwitchB] isis

[SwitchB-isis-1] is-level level-2

[SwitchB-isis-1] network-entity 10.0000.0000.0002.00

[SwitchB-isis-1] quit

[SwitchB] interface vlan-interface 200

[SwitchB-Vlan-interface200] isis enable

[SwitchB-Vlan-interface200] quit

3)         Configure OSPF and route redistribution

# Configure Switch A: enable OSPF.

<SwitchA> system-view

[SwitchA] ospf

[SwitchA-ospf-1] area 0

[SwitchA-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255

[SwitchA-ospf-1-area-0.0.0.0] quit

[SwitchA-ospf-1] quit

# Configure Switch B: enable OSPF and redistribute routes from IS-IS.

[SwitchB] ospf

[SwitchB-ospf-1] area 0

[SwitchB-ospf-1-area-0.0.0.0] network 192.168.1.0 0.0.0.255

[SwitchB-ospf-1-area-0.0.0.0] quit

[SwitchB-ospf-1] import-route isis 1

[SwitchB-ospf-1] quit

# Display OSPF routing table on Switch A to view redistributed routes.

[SwitchA] display ospf routing

 

          OSPF Process 1 with Router ID 192.168.1.1

                   Routing Tables

 

 Routing for Network

 Destination        Cost     Type    NextHop        AdvRouter     Area

 192.168.1.0/24     1562     Stub    192.168.1.1    192.168.1.1   0.0.0.0

 

 Routing for ASEs

 Destination        Cost     Type    Tag        NextHop        AdvRouter

 172.17.1.0/24      1        Type2   1          192.168.1.2    192.168.2.2

 172.17.2.0/24      1        Type2   1          192.168.1.2    192.168.2.2

 172.17.3.0/24      1        Type2   1          192.168.1.2    192.168.2.2

 192.168.2.0/24     1        Type2   1          192.168.1.2    192.168.2.2

 

 Total Nets: 5

 Intra Area: 1  Inter Area: 0  ASE: 4  NSSA: 0

4)         Configure filtering lists

# Configure an ACL with the number of 2002, letting pass route 172.17.2.0/24.

[SwitchB] acl number 2002

[SwitchB-acl-basic-2002] rule permit source 172.17.2.0 0.0.0.255

[SwitchB-acl-basic-2002] quit

# Configure an IP prefix list named prefix-a, letting pass route 172.17.1.0/24.

[SwitchB] ip ip-prefix prefix-a index 10 permit 172.17.1.0 24

5)         Configure a routing policy.

[SwitchB] route-policy isis2ospf permit node 10

[SwitchB-route-policy] if-match ip-prefix prefix-a

[SwitchB-route-policy] apply cost 100

[SwitchB-route-policy] quit

[SwitchB] route-policy isis2ospf permit node 20

[SwitchB-route-policy] if-match acl 2002

[SwitchB-route-policy] apply tag 20

[SwitchB-route-policy] quit

[SwitchB] route-policy isis2ospf permit node 30

[SwitchB-route-policy] quit

6)         Apply the routing policy to route redistribution.

# Configure Switch B: apply the routing policy when redistributing routes.

[SwitchB] ospf

[SwitchB-ospf-1] import-route isis 1 route-policy isis2ospf

[SwitchB-ospf-1] quit

# Display the OSPF routing table on Switch A. You can find the cost of route 172.17.1.0/24 is 100, tag of route 172.17.1.0/24 is 20, and other external routes have no change.

[SwitchA] display ospf routing

 

          OSPF Process 1 with Router ID 192.168.1.1

                   Routing Tables

 

 Routing for Network

 Destination        Cost     Type    NextHop         AdvRouter     Area

 192.168.1.0/24       1     Transit    192.168.1.1     192.168.1.1   0.0.0.0

 

 Routing for ASEs

 Destination        Cost     Type    Tag         NextHop       AdvRouter

 172.17.1.0/24      100      Type2   1           192.168.1.2   192.168.2.2

 172.17.2.0/24      1        Type2   20          192.168.1.2   192.168.2.2

 172.17.3.0/24      1        Type2   1           192.168.1.2   192.168.2.2

 192.168.2.0/24     1        Type2   1           192.168.1.2   192.168.2.2

 

 Total Nets: 5

 Intra Area: 1  Inter Area: 0  ASE: 4  NSSA: 0

1.6.2  Applying Routing Policy When Redistributing IPv6 Routes

I. Network requirements

l           Enable RIPng and configure three static routes on Switch A.

l           Apply a routing policy when redistributing static routes, making routes in 20::0/32 and 40::0/32 pass, routes in 30::0/32 filtered.

l           Display RIPng routing table information on Switch B to verify the configuration.

II. Network diagram

Figure 1-2 Network diagram for routing policy application to route redistribution

III. Configuration procedure

1)         Configure Switch A

# Configure IPv6 addresses for Vlan-interface 100 and Vlan-interface 200.

<SwitchA> system-view

[SwitchA] ipv6

[SwitchA] interface vlan-interface 100

[SwitchA-Vlan-interface100] ipv6 address 10::1 32

[SwitchA-Vlan-interface100] quit

[SwitchA] interface vlan-interface 200

[SwitchA-Vlan-interface200] ipv6 address 11::1 32

[SwitchA-Vlan-interface200] quit

# Enable RIPng on Vlan-interface 100.

[SwitchA] interface vlan-interface 100

[SwitchA-Vlan-interface100] ripng 1 enable

[SwitchA-Vlan-interface100] quit

# Configure three static routes.

[SwitchA] ipv6 route-static 20:: 32 11::2

[SwitchA] ipv6 route-static 30:: 32 11::2

[SwitchA] ipv6 route-static 40:: 32 11::2

# Configure routing policy.

[SwitchA] ip ipv6-prefix a index 10 permit 30:: 32

[SwitchA] route-policy static2ripng deny node 0

[SwitchA-route-policy] if-match ipv6 address prefix-list a

[SwitchA-route-policy] quit

[SwitchA] route-policy static2ripng permit node 10

[SwitchA-route-policy] quit

# Enable RIPng and redistribute static routes.

[SwitchA] ripng

[SwitchA-ripng-1] import-route static route-policy static2ripng

2)         Configure Switch B.

# Configure the IPv6 address for Vlan-interface 100.

[SwitchB] ipv6

[SwitchB] interface vlan-interface 100

[SwitchB-Vlan-interface100] ipv6 address 10::2 32

# Enable RIPng on Vlan-interface 100.

[SwitchB-Vlan-interface100] ripng 1 enable

[SwitchB-Vlan-interface100] quit

# Enable RIPng.

[SwitchB] ripng

# Display RIPng routing table information.

[SwitchB-ripng-1] display ripng 1 route

   Route Flags: A - Aging, S - Suppressed, G - Garbage-collect

 ----------------------------------------------------------------

 

 Peer FE80::7D58:0:CA03:1  on Vlan-interface 100

 Dest 10::/32,

     via FE80::7D58:0:CA03:1, cost  1, tag 0, A, 18 Sec

 Dest 20::/32,

     via FE80::7D58:0:CA03:1, cost  1, tag 0, A, 8 Sec

 Dest 40::/32,

     via FE80::7D58:0:CA03:1, cost  1, tag 0, A, 3 Sec 

1.7  Troubleshooting Routing Policy Configuration

1.7.1  IPv4 Routing Information Filtering Failure

I. Symptom

Filtering routing information failed, while routing protocol runs normally.

II. Analysis

At least one item of the IP prefix list should be configured as permit mode, and at least one node in the Route-policy should be configured as permit mode.

III. Processing procedure

1)         Use the display ip ip-prefix command to display IP prefix list information.

2)         Use the display route-policy command to display routing policy information.

1.7.2  IPv6 Routing Information Filtering Failure

I. Symptom

Filtering routing information failed, while routing protocol runs normally.

II. Analysis

At least one item of the IPv6 prefix list should be configured as permit mode, and at least one node of the Route-policy should be configured as permit mode.

III. Processing procedure

1)         Use the display ip ipv6-prefix command to display IP prefix list information.

2)         Use the display route-policy command to display routing policy information.