Configuring IPv6 policy-based routing· 1

Introduction to IPv6 policy-based routing· 1

Policy-based routing· 1

IPv6 PBR· 1

Configuring IPv6 PBR· 2

Defining an IPv6 policy· 2

Configuring IPv6 local PBR· 3

Configuring IPv6 interface PBR· 3

Displaying and maintaining IPv6 PBR configuration· 4

IPv6 PBR configuration examples 5

Configuring IPv6 local PBR based on packet type· 5

Configuring IPv6 interface PBR based on packet type· 7

 

Introduction to IPv6 policy-based routing

IPv6 policy-based routing is used to route IPv6 unicasts based on a policy.

Policy-based routing

Policy-based routing (PBR) is a routing mechanism based on the user-defined policies. Different from the traditional destination-based routing mechanism, PBR enables you to implement policies (based on the source address, address length, and other criteria) that make packets flexibly take different routes. You can specify the packet priority and next hop to guide forwarding of the packets matching an ACL.

According to the objects to which the PBR applies, PBR involves local PBR and interface PBR:

·           Local PBR applies to locally generated packets only, such as the ICMP packets generated by using the ping command.

·           Interface PBR applies to packets forwarded through an interface only.

In most cases, interface PBR is implemented to meet the forwarding and security requirements.

In general, PBR takes precedence over destination-based routing. PBR is applied when packets match the specified criteria. Otherwise, destination-based routing is applied.

IPv6 PBR

An IPv6 policy is used to route IPv6 packets.

An IPv6 policy can consist of one or multiple nodes.

Node

A node is identified by a node number. The node with the smallest node number has the highest priority.

A policy consists of if-match and apply clauses. An if-match clause defines specifies a match criterion on a node, and an apply clause specifies action to be taken on packets.

The action to be taken on matched packets depends on the match mode, which can be permit or deny

Table 1 Relationship between the match mode and the clauses

If a packet…	Then…
	In permit mode	In deny mode
Matches all the if-match clauses on the policy node	The apply clause is executed, and the packet will not go to the next policy node for a match.	The apply clause is not executed, the packets will not go to the next policy node for a match, and will be forwarded according to the routing table.
Fails to match an if-match clause on the policy node	The apply clause is not executed, and the packet will go to the next policy node for a match.	The apply clause is not executed, and the packet will go to the next policy node for a match.

 

NOTE: ·       If a policy has a node with no if-match clause configured, all packets can pass the policy node. However, an action is taken according to the match mode, and the packets will not go to the next policy node for a match. ·       If a policy has a node with the permit match mode but no apply clause configured, all packets matching all the if-match clauses can pass the policy node. However, no action is taken, the packets will not go to the next policy node for a match, and will be forwarded according to the routing table. ·       If a policy has a node with no if-match or apply clauses configured, all packets can pass the policy node. However, no action is taken; the packets will not go to the next policy node for a match, and will be forwarded according to the routing table.

 

The nodes of a policy are in an OR relationship. If a packet matches a node, it passes the policy; if the packet does not match any node of the policy, it fails to pass the policy and is forwarded according to the routing table.

if-match clause

The following type of if-match clause is available: if-match acl6.

You can specify only one if-match clause in a policy node.

apply clause

Table 2 describes the following types of apply clauses.

Table 2 Priorities of the apply clauses in a policy node

Clause	Meaning	Priority
apply ipv6-precedence	Sets an IP precedence.	If configured, this clause will always be executed.
apply ipv6-address next-hop	Sets the next hop.	This clause will be executed when the configured next hop is valid.

 

NOTE: If the ARP entry of the specified next hop can be learned, the next hop is considered valid; otherwise, it is considered invalid.

 

Configuring IPv6 PBR

Defining an IPv6 policy

To define an IPv6 policy:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Create an IPv6 policy or IPv6 policy node and enter IPv6 PBR policy node view.	ipv6 policy-based-route policy-name [ deny | permit ] node node-number	Not created by default.
3.     Define an IPv6 ACL match criterion.	if-match acl6 acl6-number	Optional.
4.     Set a preference type or value for permitted IPv6 packets.	apply ipv6-precedence { type | value }	Optional.
5.     Set a next hop for permitted IPv6 packets.	apply ipv6-address next-hop ipv6-address	Optional. You can define two next hops at most. Only one next hop can be active at a time, the other one is for backup.

 

NOTE: ·       If an ACL match criterion is defined, packets are matched against the ACL rules, whereas the permit or deny action of the specified ACL is ignored. If the specified ACL does not exist, no packet is matched. ·       The rule you add to an ACL that has been used by a policy cannot take effect if hardware resources are insufficient or the policy does not support the rule. Such rules are marked as uncompleted in the output of the display acl { acl-number | all | name acl-name } slot slot-number command. To successfully apply the rule, you must delete the rule and reconfigure it when hardware resources are sufficient. For more information about the display acl command, see ACL and QoS Command Reference.

 

Configuring IPv6 local PBR

Only one policy can be referenced for IPv6 local PBR.

To configure IPv6 local PBR:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Configure IPv6 local PBR.	ipv6 local policy-based-route policy-name	Not configured by default

 

NOTE: If the specified policy does not exist, the IPv6 local PBR configuration succeeds, but it takes effect only when the policy is created.

 

Configuring IPv6 interface PBR

Only one policy can be referenced by an interface for IPv6 interface PBR.

To configure IPv6 interface PBR:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter interface view.	interface interface-type interface-number	N/A
3.     Configure IPv6 interface PBR.	ipv6 policy-based-route policy-name	Not configured by default

 

NOTE: If the specified policy does not exist, the IPv6 interface PBR configuration succeeds, but it takes effect only when the policy is created.

 

Displaying and maintaining IPv6 PBR configuration

 

Task	Command	Remarks
Display the specified IPv6 PBR routing information.	display ipv6 policy-based-route setup { policy-name | interface interface-type interface-number [ slot slot-number ] | local [ slot slot-number ] } [ | { begin | exclude | include } regular-expression ]	Available in any view
Display IPv6 PBR statistics.	display ipv6 policy-based-route statistics { interface interface-type interface-number | local } [ slot slot-number ] [ | { begin | exclude | include } regular-expression ]	Available in any view
Display IPv6 PBR policy information.	display ipv6 config policy-based-route [ policy-name [ slot slot-number ] ] [ | { begin | exclude | include } regular-expression ]	Available in any view
Clear IPv6 PBR statistics.	reset ipv6 policy-based-route statistics	Available in user view

 

NOTE: ·       If a policy has a node with no if-match or apply clause configured, all packets can pass the policy and will not go to the next policy node for a match. The statistics of IPv6 PBR will be changed. ·       If a policy node has if-match clauses but no apply clauses configured, packets will match against these if-match clauses. However, no apply clauses are applicable to the permitted packets, and the packets will not go to the next node for a match. The statistics of IPv6 PBR will be changed. ·       If a policy node has no if-match clause but apply clauses configured, all packets can pass the policy, and then are forwarded according to the apply clauses if the permit keyword is specified for the node, or are denied if the deny keyword is specified. The packets will not go to the next policy node for a match. The statistics of IPv6 PBR will be changed. ·       If the match mode of a policy node is deny, no apply clauses will be executed for packets satisfying all the if-match clauses, and the packets will not go to the next policy node for a match. They will be forwarded according to the routing table instead. Neither debugging information nor statistics for the deny match mode can be displayed.

 

IPv6 PBR configuration examples

Configuring IPv6 local PBR based on packet type

Network requirements

As shown in Figure 1, configure PBR on Router A, so that all TCP packets are forwarded via next hop 1::2 and other IPv6 packets are forwarded according to the routing table.

Router A is directly connected to Router B and Router C. Router B and Router C are unreachable to each other.

Figure 1 Network diagram

Configuration procedure

1.      Configure Router A:

# Define ACL 3001 to match TCP packets.

<RouterA> system-view

[RouterA] ipv6

[RouterA] acl ipv6 number 3001

[RouterA-acl6-adv-3001] rule permit tcp

[RouterA-acl6-adv-3001] quit

# Define Node 5 of policy aaa, so that TCP packets are forwarded via next hop 1::2.

[RouterA] ipv6 policy-based-route aaa permit node 5

[RouterA-pbr6-aaa-5] if-match acl6 3001

[RouterA-pbr6-aaa-5] apply ip-address next-hop 1::2

[RouterA-pbr6-aaa-5] quit

# Apply policy aaa to Router A.

[RouterA] ipv6 local policy-based-route aaa

# Configure the IPv6 addresses of the serial ports.

[RouterA] interface Serial 2/1/9/1:0

[RouterA-Serial2/1/9/1:0] ipv6 address 1::1 64

[RouterA-Serial2/1/9/1:0] quit

[RouterA] interface Serial 2/1/9/2:0

[RouterA-Serial2/1/9/2:0] ipv6 address 2::1 64

2.      Configure Router B:

# Configure the IPv6 address for the serial port.

<RouterB> system-view

[RouterB] ipv6

[RouterB] interface Serial 3/1/9/1:0

[RouterB-Serial3/1/9/1:0] ipv6 address 1::2 64

[RouterB-Serial3/1/9/1:0] quit

3.      Configure Router C:

# Configure the IPv6 address for the serial port.

<RouterC> system-view

[RouterC] ipv6

[RouterC] interface Serial 3/1/9/2:0

[RouterC-Serial3/1/9/2:0] ipv6 address 2::2 64

[RouterC-Serial3/1/9/2:0] quit

4.      Verify the configuration:

# Telnet to Router B (1::2/64) from Router A. The operation succeeds.

<RouterA> telnet ipv6 1::2

Trying 1::2 ...

Press CTRL+K to abort

Connected to 1::2 ...

******************************************************************************

* Copyright (c) 2004-2011 Hangzhou H3C Tech. Co., Ltd. All rights reserved.  *

* Without the owner's prior written consent,                                 *

* no decompiling or reverse-engineering shall be allowed.                    *

******************************************************************************

# Telnet to Router C (2::2/64) from Router A. The operation fails.

<RouterA> telnet ipv6 2::2

Trying 2::2 ...

Press CTRL+K to abort

Can't connect to the remote host!

# Ping Router C (2::2/64) from Router A. The operation succeeds.

<RouterA> ping ipv6 2::2

  PING 2::2 : 56  data bytes, press CTRL_C to break

    Reply from 2::2

    bytes=56 Sequence=1 hop limit=64  time = 4 ms

    Reply from 2::2

    bytes=56 Sequence=2 hop limit=64  time = 2 ms

    Reply from 2::2

    bytes=56 Sequence=3 hop limit=64  time = 2 ms

    Reply from 2::2

    bytes=56 Sequence=4 hop limit=64  time = 2 ms

    Reply from 2::2

    bytes=56 Sequence=5 hop limit=64  time = 2 ms

 

  --- 2::2 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 2/2/4 ms

 

Telnet uses TCP, and ping uses IMCP. The preceding results show that all TCP packets of Router A are forwarded via next hop 1::2, and other packets are forwarded according to the routing table. The PBR configuration is effective.

Configuring IPv6 interface PBR based on packet type

Network requirements

As shown in Figure 2, configure PBR on Router A, so that TCP packets arriving on the interface GigabitEthernet 3/1/1 are forwarded via next hop 1::2 and other IPv6 packets are forwarded according to the routing table.

Figure 2 Network diagram

 

Configuration procedure

 

NOTE: In this example, RIPng is configured to ensure the reachability among routers.

 

1.      Configure Router A:

# Configure RIPng.

<RouterA> system-view

[RouterA] ipv6

[RouterA] ripng 1

[RouterA-ripng-1] quit

[RouterA] interface Serial 2/1/9/2:0

[RouterA-Serial2/1/9/2:0] ipv6 address 1::1 64

[RouterA-Serial2/1/9/2:0] ripng 1 enable

[RouterA-Serial2/1/9/2:0] quit

[RouterA] interface Serial 2/1/9/1:0

[RouterA-Serial2/1/9/1:0] ipv6 address 2::1 64

[RouterA-Serial2/1/9/1:0] ripng 1 enable

[RouterA-Serial2/1/9/1:0] quit

# Define ACL 3001 to match TCP packets.

[RouterA] acl ipv6 number 3001

[RouterA-acl6-adv-3001] rule permit tcp

[RouterA-acl6-adv-3001] quit

# Define Node 5 of policy aaa, so that TCP packets are forwarded via next hop 1::2.

[RouterA] ipv6 policy-based-route aaa permit node 5

[RouterA-pbr-aaa-5] if-match acl6 3001

[RouterA-pbr-aaa-5] apply ipv6-address next-hop 1::2

[RouterA-pbr-aaa-5] quit

# Apply policy aaa on GigabitEthernet 3/1/1.

[RouterA] interface GigabitEthernet 3/1/1

[RouterA-GigabitEthernet3/1/1] ipv6 address 10::2 64

[RouterA-GigabitEthernet3/1/1] undo ipv6 nd ra halt

[RouterA-GigabitEthernet3/1/1] ripng 1 enable

[RouterA-GigabitEthernet3/1/1] ipv6 policy-based-route aaa

[RouterA-GigabitEthernet3/1/1] quit

2.      Configure Router B:

# Configure RIPng.

<RouterB> system-view

[RouterB] ipv6

[RouterB] ripng 1

[RouterB-ripng-1] quit

[RouterB] interface Serial 3/1/9/2:0

[RouterB-Serial3/1/9/2:0] ipv6 address 1::2 64

[RouterB-Serial3/1/9/2:0] ripng 1 enable

[RouterB-Serial3/1/9/2:0] quit

3.      Configure Router C:

# Configure RIPng.

<RouterC> system-view

[RouterC] ipv6

[RouterC] ripng 1

[RouterC-ripng-1] quit

[RouterC] interface Serial 3/1/9/1:0

[RouterC-Serial3/1/9/1:0] ipv6 address 2::2 64

[RouterC-Serial3/1/9/1:0] ripng 1 enable

[RouterC-Serial3/1/9/1:0] quit

4.      Verify the configuration:

Enable IPv6 on Host A and configure the IPv6 address of Host A as 10::3.

C:\>ipv6 install

Installing...

Succeeded.

C:\>ipv6 adu 4/10::3

On Host A, telnet to Router B (1::2) that is directly connected to Router A. The operation succeeds.

On Host A, telnet to Router C (2::2) that is directly connected to Router A. The operation fails.

Ping Router C from Host A. The operation succeeds.

Telnet uses TCP, and ping uses ICMP. The preceding results show that all TCP packets received on interface GigabitEthernet 3/1/1 of Router A are forwarded via next hop 1::2, and other packets received on Router C are forwarded via next hop 2::2. The PBR configuration is effective.