Configuring PBR· 1

Introduction to PBR· 1

Policy· 1

PBR and track· 2

PBR configuration task list 2

Configuring a policy· 2

Creating a node· 2

Configuring match criteria for a node· 3

Configuring actions for a node· 3

Configuring PBR· 3

Displaying and maintaining PBR· 4

Packet type-based interface PBR configuration example· 4

The switch operates in IRF or standalone (the default) mode. For more information about IRF, see IRF Configuration Guide.

Introduction to PBR

Different from destination-based routing, policy-based routing (PBR) uses user-defined policies to route packets. A policy can specify the next hop and other parameters for packets that match specific criteria, such as ACLs.

A device uses PBR to forward matching packets and uses the routing table to forward other packets. If PBR is not configured, the device uses the routing table to forward packets.

The device supports only interface PBR, which guides the forwarding of packets received on an interface only.

Policy   

A policy comprises match criteria and actions to be taken on the matching packets. A policy can have one or multiple nodes as follows:

·           Each node is identified by a node number. A smaller node number has a higher priority.

·           A node comprises if-match and apply clauses. An if-match clause specifies a match criterion, and an apply clause specifies an action.

·           A node has a match mode of permit or deny.

A policy matches nodes in priority order against packets. If a packet satisfies the match criteria on a node, it is processed by the action on the node. Otherwise, it goes to the next node for a match. If the packet does not match the criteria on any node, it is forwarded according to the routing table.

if-match clause

PBR supports only the if-match acl clause, which sets an ACL match criterion.

You can specify only one if-match clause of each type for a node.

apply clause

PBR supports only the apply next-hop clause, which sets the next hop for packets.

Relationship between the match mode and clauses on the node

 

Does a packet match the if-match clause on the node?	Match mode
	permit	Deny
Yes.	·       If the node is configured with an apply clause, PBR executes the apply clause on the node. ·       If the node is configured with no apply clause, the packet is forwarded according to the routing table.	The packet is forwarded according to the routing table.
No.	PBR matches the packet against the next node.	PBR matches the packet against the next node.

 

A node that has no if-match clause matches any packet.

PBR and track

PBR can work with the Track feature to dynamically adapt the availability status of a node configured with an apply clause to the link status of a tracked next hop.

When the track entry associated with the node changes to negative because the next hop is detected as being unavailable, the node cannot be used for forwarding. When the track entry changes to positive or NotReady because the next hop is detected as being available, the node can be used for forwarding.

For more information about track-PBR collaboration, see High Availability Configuration Guide.

PBR configuration task list

 

Tasks at a glance
(Required.) Configuring a policy: ·       Creating a node ·       Configuring match criteria for a node ·       Configuring actions for a node
(Required.) Configuring PBR

 

Configuring a policy

Creating a node

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Create a node for a policy, and enter policy node view.	policy-based-route policy-name [ deny | permit ] node node-number	By default, no policy node is created.

 

Configuring match criteria for a node

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter policy node view.	policy-based-route policy-name [ deny | permit ] node node-number	N/A
3.     Configure an ACL match criterion.	if-match acl acl-number	By default, no ACL match criterion is configured.

 

If an ACL match criterion is defined, packets are matched against the ACL rules, and the permit or deny action of the specified ACL is ignored. If the specified ACL does not exist, no packet is matched.

Configuring actions for a node

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter policy node view.	policy-based-route policy-name [ deny | permit ] node node-number	N/A
3.     Set next hops.	apply next-hop [ vpn-instance vpn-instance-name ] { ip-address [ direct ] [ track track-entry-number ] }&<1-2>	By default, no next hop is specified. You can specify at most two next hops for backup. The first next hop configured is the active next hop and the second is the standby next hop.

 

Configuring PBR

Configure PBR by applying a policy to an interface. PBR uses the policy to guide the forwarding of packets received on the interface. The specified policy must exist. Otherwise, the interface PBR configuration fails.

You can apply only one policy on an interface. Before you apply a new policy, you must first remove the current policy from the interface.

You can apply the same policy on multiple interfaces.

To configure interface PBR:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter interface view.	interface interface-type interface-number	N/A
3.     Apply a policy on the interface.	ip policy-based-route policy-name	By default, no policy is applied on the interface.

 

Displaying and maintaining PBR

Execute display commands in any view and reset commands in user view.

 

Task	Command
Display PBR policy information.	display ip policy-based-route [ policy policy-name ]
Display PBR configuration.	display ip policy-based-route setup
Display interface PBR configuration and statistics (in standalone mode).	display ip policy-based-route interface interface-type interface-number [ slot slot-number ]
Display interface PBR configuration and statistics (in IRF mode).	display ip policy-based-route interface interface-type interface-number [ chassis chassis-number slot slot-number ]
Clear PBR statistics.	reset ip policy-based-route statistics [ policy policy-name ]

 

Packet type-based interface PBR configuration example

By default, Ethernet, VLAN, and aggregate interfaces are down. To configure such an interface, bring the interface up by executing the undo shutdown command.

Network requirements

As shown in Figure 1, configure PBR on Switch A to forward all TCP packets received on VLAN-interface 11 to the next hop 1.1.2.2. Switch A forwards other packets according to the routing table.

Figure 1 Network diagram

 

Configuration procedure

1.      Configure Switch A:

# Configure ACL 3101 to match TCP packets.

<SwitchA> system-view

[SwitchA] acl number 3101

[SwitchA-acl-adv-3101] rule permit tcp

[SwitchA-acl-adv-3101] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1.1.2.2.

[SwitchA] policy-based-route aaa permit node 5

[SwitchA-pbr-aaa-5] if-match acl 3101

[SwitchA-pbr-aaa-5] apply next-hop 1.1.2.2

[SwitchA-pbr-aaa-5] quit

# Configure interface PBR by applying the policy aaa on VLAN-interface 11.

[SwitchA] interface vlan-interface 11

[SwitchA-Vlan-interface11] ip address 10.110.0.10 255.255.255.0

[SwitchA-Vlan-interface11] ip policy-based-route aaa

[SwitchA-Vlan-interface11] quit

# Configure the IP addresses of VLAN-interface 10 and VLAN-interface 20.

[SwitchA] interface vlan-interface 10

[SwitchA-Vlan-interface10] ip address 1.1.2.1 255.255.255.0

[SwitchA-Vlan-interface10] quit

[SwitchA] interface vlan-interface 20

[SwitchA-Vlan-interface20] ip address 1.1.3.1 255.255.255.0

2.      Configure Switch B:

# Configure a static route to subnet 10.110.0.0/24.

<SwitchB> system-view

[SwitchB] ip route-static 10.110.0.0 24 1.1.2.1

# Configure the IP address of VLAN-interface 10.

[SwitchB] interface vlan-interface 10

[SwitchB-Vlan-interface10] ip address 1.1.2.2 255.255.255.0

3.      Configure Switch C:

# Configure a static route to subnet 10.110.0.0/24.

<SwitchC> system-view

[SwitchC] ip route-static 10.110.0.0 24 1.1.3.1

# Configure the IP address of VLAN-interface 20.

[SwitchC] interface vlan-interface 20

[SwitchC-Vlan-interface20] ip address 1.1.3.2 255.255.255.0

Verifying the configuration

# Configure the IP address 10.110.0.20/24 for Host A, and specify its gateway address as 10.110.0.10.

# On Host A, Telnet to Switch B that is directly connected to Switch A. The operation succeeds.

# On Host A, Telnet to Switch C that is directly connected to Switch A. The operation fails.

# Ping Switch C from Host A. The operation succeeds.

Telnet uses TCP and ping uses ICMP. The preceding results show that all TCP packets arriving on VLAN-interface 11 of Switch A are forwarded to next hop 1.1.2.2, and other packets are forwarded through VLAN-interface 20. The interface PBR configuration is effective.