Policy-based routing (PBR) uses user-defined policies to route packets. A policy can specify the next hop and default next hop for packets that match specific criteria such as ACLs.

A device forwards received packets using the following process:

1. The device uses PBR to forward matching packets.

2. If the packets do not match the PBR policy or the PBR-based forwarding fails, the device uses the routing table, excluding the default route, to forward the packets.

3. If the routing table-based forwarding fails, the device uses the default next hop defined in PBR to forward packets.

4. If the default next hop-based forwarding fails, the device uses the default route to forward packets.

PBR includes local PBR and interface PBR.

· Local PBR guides the forwarding of locally generated packets, such as the ICMP packets generated by using the ping command.

· Interface PBR guides the forwarding of packets received on an interface only.

Policy

A policy includes match criteria and actions to be taken on the matching packets. A policy can have one or multiple nodes as follows:

· Each node is identified by a node number. A smaller node number has a higher priority.

· A node contains if-match and apply clauses. An if-match clause specifies a match criterion, and an apply clause specifies an action.

· A node has a match mode of permit or deny.

A policy compares packets with nodes in priority order. If a packet matches the criteria on a node, it is processed by the action on the node. If the packet does not match any criteria on the node, it goes to the next node for a match. If the packet does not match the criteria on any node, it is forwarded according to the routing table.

if-match clause

PBR supports the following types of if-match clauses:

· if-match acl—Sets an ACL match criterion.

· if-match service-chain—Sets a service chain match criterion. For more information about service chain, see Service Chain Configuration Guide.

On a node, you can specify multiple types of if-match clauses, but only one if-match clause for each type.

To match a node, a packet must match all types of the if-match clauses for the node but only one if-match clause for each type.

apply clause

PBR supports the types of apply clauses shown in Table 1. You can specify multiple apply clauses for a node, but some of them might not be executed. The following apply clauses determine the packet forwarding paths in a descending order:

· apply next-hop

· apply output-interface

· apply default-next-hop

Table 1 Priorities and meanings of apply clauses

Clause	Meaning	Priority
apply precedence	Sets an IP precedence.	This clause is always executed.
apply next-hop and apply output-interface	Sets next hops and sets output interfaces.	Only the apply next-hop clause is executed when both are configured.
apply service-chain	Sets the service chain information.	For this clause to take effect, make sure you have specified a reachable next hop in the apply next-hop clause.
apply default-next-hop	Sets the default next hop.	This clause takes effect only when no next hop is set or the next hop is invalid, and the packet does not match any route in the routing table.

Relationship between the match mode and clauses on the node

Does a packet match all the if-match clauses on the node?	Match mode
Does a packet match all the if-match clauses on the node?	Permit	Deny
Yes.	· If the node contains apply clauses, PBR executes the apply clauses on the node. ¡ If the PBR-based forwarding succeeds, PBR does not compare the packet with the next node. ¡ If the PBR-based forwarding fails, PBR does not compare the packet with the next node. · If the node does not contain apply clauses, the packet is forwarded according to the routing table.	The packet is forwarded according to the routing table.
No.	PBR compares the packet with the next node.	PBR compares the packet with the next node.

A node that has no if-match clauses matches any packet.

PBR and Track

PBR can work with the Track feature to dynamically adapt the availability status of an apply clause to the link status of a tracked next hop or default next hop.

· When the track entry associated with an object changes to Negative, the apply clause is invalid.

· When the track entry changes to Positive or NotReady, the apply clause is valid.

For more information about Track-PBR collaboration, see High Availability Configuration Guide.

PBR configuration task list

Tasks at a glance
(Required.) Configuring a policy: · Creating a node · Setting match criteria for a node · Configuring actions for a node
(Required.) Configuring PBR: · Configuring local PBR · Configuring interface PBR

Tasks at a glance

(Required.) Configuring a policy:

· Creating a node

· Setting match criteria for a node

· Configuring actions for a node

(Required.) Configuring PBR:

· Configuring local PBR

· Configuring interface PBR

Configuring a policy

Creating a node

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Create a node for a policy, and enter policy node view.	policy-based-route policy-name [ deny \| permit ] node node-number	By default, no policy node is created.
3. (Optional.) Configure a description for the policy node.	description text	By default, no description is configured for the policy node.

Setting match criteria for a node

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter policy node view.	policy-based-route policy-name [ deny \| permit ] node node-number	N/A
3. Set an ACL match criterion.	if-match acl { acl-number \| name acl-name }	By default, no ACL match criterion is set. If an ACL match criterion is defined, packets are compared with the ACL rules, and the permit or deny action and the time range of the specified ACL are ignored. If the specified ACL does not exist, no packet is matched.
4. Set a service chain match criterion.	if-match service-chain { path-id service-path-id [ path-index service-patch-index ] }	By default, no service chain match criterion is set. A policy that contains this clause is not supported on Layer 3 Ethernet subinterfaces.

Configuring actions for a node

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter policy node view.	policy-based-route policy-name [ deny \| permit ] node node-number	N/A
3. Set an IP precedence.	apply precedence { type \| value }	By default, no IP precedence is specified.
4. Set next hops.	apply next-hop [ vpn-instance vpn-instance-name ] { ip-address [ direct ] [ track track-entry-number ] }&<1-2>	By default, no next hop is specified. You can specify two next hops for backup in one command line or by executing this command twice. You can specify a maximum of two next hops for a node. The vpn-instance vpn-instance-name option is not supported in the current software version.
5. Set output interfaces.	apply output-interface { interface-type interface-number [ track track-entry-number ] }	By default, no output interface is specified.
6. Set default next hops.	apply default-next-hop [ vpn-instance vpn-instance-name ] { ip-address [ direct ] [ track track-entry-number ] }&<1-2>	By default, no default next hop is specified. You can specify two default next hops for backup in one command line or by executing this command twice. You can specify a maximum of two default next hops for a node. The vpn-instance vpn-instance-name option does not take effect.
7. Set the service chain information.	apply service-chain path-id service-path-id [ path-index service-patch-index ]	By default, no service chain information is set. A policy that contains this clause is not supported on Layer 3 Ethernet subinterfaces. This clause does not apply to software forwarded packets.

Configuring PBR

Configuring local PBR

Configure PBR by applying a policy locally. PBR uses the policy to guide the forwarding of locally generated packets. The specified policy must already exist. If the policy does not exist, the local PBR configuration fails.

You can apply only one policy locally. Before you apply a new policy, you must first remove the current policy.

Local PBR might affect local services, such as ping and Telnet. Do not configure local PBR unless doing so is required.

To configure local PBR:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Apply a policy locally.	ip local policy-based-route policy-name	By default, no policy is locally applied.

Configuring interface PBR

Configure PBR by applying a policy to an interface. PBR uses the policy to guide the forwarding of packets received on the interface. The specified policy must already exist. If the policy does not exist, the interface PBR configuration fails.

You can apply only one policy to an interface. Before you apply a new policy, you must first remove the current policy from the interface.

You can apply a policy to multiple interfaces.

To configure interface PBR:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter interface view.	interface interface-type interface-number	N/A
3. Apply a policy to the interface.	ip policy-based-route policy-name	By default, no policy is applied to the interface.

Displaying and maintaining PBR

Execute display commands in any view and reset commands in user view.

Task	Command
Display PBR policy information.	display ip policy-based-route [ policy policy-name ]
Display PBR configuration.	display ip policy-based-route setup
(In standalone mode.) Display local PBR configuration and statistics.	display ip policy-based-route local [ slot slot-number ]
(In IRF mode.) Display local PBR configuration and statistics.	display ip policy-based-route local [ chassis chassis-number slot slot-number ]
(In standalone mode.) Display interface PBR configuration and statistics.	display ip policy-based-route interface interface-type interface-number [ slot slot-number ]
(In IRF mode.) Display interface PBR configuration and statistics.	display ip policy-based-route interface interface-type interface-number [ chassis chassis-number slot slot-number ]
Clear PBR statistics.	reset ip policy-based-route statistics [ policy policy-name ]

PBR configuration examples

Packet type-based local PBR configuration example

Network requirements

As shown in Figure 1, configure PBR on Switch A to forward all TCP packets to the next hop 1.1.2.2. Switch A forwards other packets according to the routing table.

Figure 1 Network diagram

Configuration procedure

1. Configure Switch A:

# Create VLAN 10 and VLAN 20.

<SwitchA> system-view

[SwitchA] vlan 10

[SwitchA-vlan10] quit

[SwitchA] vlan 20

[SwitchA-vlan20] quit

# Configure the IP addresses of VLAN-interface 10 and VLAN-interface 20.

[SwitchA] interface vlan-interface 10

[SwitchA-Vlan-interface10] ip address 1.1.2.1 24

[SwitchA-Vlan-interface10] quit

[SwitchA] interface vlan-interface 20

[SwitchA-Vlan-interface20] ip address 1.1.3.1 24

[SwitchA-Vlan-interface20] quit

# Configure ACL 3101 to match TCP packets.

[SwitchA] acl advanced 3101

[SwitchA-acl-adv-3101] rule permit tcp

[SwitchA-acl-adv-3101] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1.1.2.2.

[SwitchA] policy-based-route aaa permit node 5

[SwitchA-pbr-aaa-5] if-match acl 3101

[SwitchA-pbr-aaa-5] apply next-hop 1.1.2.2

[SwitchA-pbr-aaa-5] quit

# Configure local PBR by applying policy aaa to Switch A.

[SwitchA] ip local policy-based-route aaa

2. Configure Switch B:

# Create VLAN 10.

<SwitchB> system-view

[SwitchB] vlan 10

[SwitchB-vlan10] quit

# Configure the IP address of VLAN-interface 10.

[SwitchB] interface vlan-interface 10

[SwitchB-Vlan-interface10] ip address 1.1.2.2 24

3. Configure Switch C:

# Create VLAN 20.

<SwitchC> system-view

[SwitchC] vlan 20

[SwitchC-vlan20] quit

# Configure the IP address of VLAN-interface 20.

[SwitchC] interface vlan-interface 20

[SwitchC-Vlan-interface20] ip address 1.1.3.2 24

Verifying the configuration

# Telnet to Switch B on Switch A. The operation succeeds.

# Telnet to Switch C on Switch A. The operation fails.

# Ping Switch C from Switch A. The operation succeeds.

Telnet uses TCP, and ping uses ICMP. The results show the following:

· All TCP packets sent from Switch A are forwarded to the next hop 1.1.2.2.

· Other packets are forwarded through VLAN-interface 20.

· The local PBR configuration is effective.

Packet type-based interface PBR configuration example

Network requirements

As shown in Figure 2, configure PBR on Switch A to forward all TCP packets received on VLAN-interface 11 to the next hop 1.1.2.2. Switch A forwards other packets according to the routing table.

Figure 2 Network diagram

Configuration procedure

1. Configure Switch A:

# Create VLAN 10 and VLAN 20.

<SwitchA> system-view

[SwitchA] vlan 10

[SwitchA-vlan10] quit

[SwitchA] vlan 20

[SwitchA-vlan20] quit

# Configure the IP addresses of VLAN-interface 10 and VLAN-interface 20.

[SwitchA] interface vlan-interface 10

[SwitchA-Vlan-interface10] ip address 1.1.2.1 24

[SwitchA-Vlan-interface10] quit

[SwitchA] interface vlan-interface 20

[SwitchA-Vlan-interface20] ip address 1.1.3.1 24

[SwitchA-Vlan-interface20] quit

# Configure ACL 3101 to match TCP packets.

[SwitchA] acl advanced 3101

[SwitchA-acl-adv-3101] rule permit tcp

[SwitchA-acl-adv-3101] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1.1.2.2.

[SwitchA] policy-based-route aaa permit node 5

[SwitchA-pbr-aaa-5] if-match acl 3101

[SwitchA-pbr-aaa-5] apply next-hop 1.1.2.2

[SwitchA-pbr-aaa-5] quit

# Configure interface PBR by applying policy aaa to VLAN-interface 11.

[SwitchA] interface vlan-interface 11

[SwitchA-Vlan-interface11] ip address 10.110.0.10 24

[SwitchA-Vlan-interface11] ip policy-based-route aaa

[SwitchA-Vlan-interface11] quit

2. Configure Switch B:

# Create VLAN 10.

<SwitchB> system-view

[SwitchB] vlan 10

[SwitchB-vlan10] quit

# Configure the IP address of VLAN-interface 10.

[SwitchB] interface vlan-interface 10

[SwitchB-Vlan-interface10] ip address 1.1.2.2 24

[SwitchB-Vlan-interface10] quit

# Configure a static route to subnet 10.110.0.0/24.

[SwitchB] ip route-static 10.110.0.0 24 1.1.2.1

3. Configure Switch C:

# Create VLAN 20.

<SwitchC> system-view

[SwitchC] vlan 20

[SwitchC-vlan20] quit

# Configure the IP address of VLAN-interface 20.

[SwitchC] interface vlan-interface 20

[SwitchC-Vlan-interface20] ip address 1.1.3.2 24

[SwitchC-Vlan-interface20] quit

# Configure a static route to subnet 10.110.0.0/24.

[SwitchC] ip route-static 10.110.0.0 24 1.1.3.1

Verifying the configuration

# Configure the IP address 10.110.0.20/24 for Host A, and specify its gateway address as 10.110.0.10.

# On Host A, Telnet to Switch B that is directly connected to Switch A. The operation succeeds.

# On Host A, Telnet to Switch C that is directly connected to Switch A. The operation fails.

# Ping Switch C from Host A. The operation succeeds.

Telnet uses TCP, and ping uses ICMP. The results show the following:

· All TCP packets arriving on VLAN-interface 11 of Switch A are forwarded to next hop 1.1.2.2.

· Other packets are forwarded through VLAN-interface 20.

· The interface PBR configuration is effective.

EVPN-based service chain PBR configuration example

Network requirements

As shown in Figure 3, Switch A, Switch B, and Switch C are distributed EVPN gateway devices. Switch D acts as a route reflector to reflect BGP routes for the other switches.

Configure PBR to direct packets sent by Server 1 to Service node 1. After being processed, the packets are forwarded to Server 2.

Figure 3 Network diagram

Configuration procedure

1. Configure IP addresses and subnet masks for interfaces, as shown in Figure 3. (Details not shown.)

2. Configure Switch A:

# Enable L2VPN.

<SwitchA> system-view

[SwitchA] l2vpn enable

# Disable remote-MAC address learning and remote ARP learning.

[SwitchA] vxlan tunnel mac-learning disable

[SwitchA] vxlan tunnel arp-learning disable

# Create an EVPN instance in VSI instance view, and configure the system to automatically generate an RT and RD.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] evpn encapsulation vxlan

[SwitchA-vsi-vpna-evpn-vxlan] route-distinguisher auto

[SwitchA-vsi-vpna-evpn-vxlan] vpn-target auto

[SwitchA-vsi-vpna-evpn-vxlan] quit

# Create VXLAN 10.

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Configure BGP to advertise EVPN routes.

[SwitchA] bgp 200

[SwitchA-bgp-default] peer 4.4.4.4 as-number 200

[SwitchA-bgp-default] peer 4.4.4.4 connect-interface loopback 0

[SwitchA-bgp-default] address-family l2vpn evpn

[SwitchA-bgp-default-evpn] peer 4.4.4.4 enable

[SwitchA-bgp-default-evpn] quit

[SwitchA-bgp-default] quit

# Create VPN instance vpna.

[SwitchA] ip vpn-instance vpna

[SwitchA-vpn-instance-vpna] route-distinguisher 1:1

[SwitchA-vpn-instance-vpna] address-family ipv4

[SwitchA-vpn-ipv4-vpna] vpn-target 2:2

[SwitchA-vpn-ipv4-vpna] quit

[SwitchA-vpn-instance-vpna] address-family evpn

[SwitchA-vpn-evpn-vpna] vpn-target 1:1

[SwitchA-vpn-evpn-vpna] quit

[SwitchA-vpn-instance-vpna] quit

# Configure VSI-interface 1.

[SwitchA] interface vsi-interface 1

[SwitchA-Vsi-interface1] ip binding vpn-instance vpna

[SwitchA-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[SwitchA-Vsi-interface1] mac-address 0001-0001-0001

[SwitchA-Vsi-interface1] local-proxy-arp enable

[SwitchA-Vsi-interface1] distributed-gateway local

[SwitchA-Vsi-interface1] quit

# Configure VSI-interface 3, associate the interface with VPN instance vpna, and set the L3 VXLAN ID to 1000.

[SwitchA] interface vsi-interface 3

[SwitchA-Vsi-interface3] ip binding vpn-instance vpna

[SwitchA-Vsi-interface3] l3-vni 1000

[SwitchA-Vsi-interface3] quit

# Associate VSI instance vpna with VSI-interface 1.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] gateway vsi-interface 1

[SwitchA-vsi-vpna] quit

# Configure VLAN-interface 11.

[SwitchA] interface vlan-interface 11

[SwitchA-Vlan-interface11] ip address 11.1.1.1 255.255.255.0

[SwitchA-Vlan-interface11] ospf 1 area 0.0.0.0

[SwitchA-Vlan-interface11] quit

# Associate Ethernet service instance 1000 with VSI instance vpna.

[SwitchA] interface gigabitethernet 1/0/1

[SwitchA-GigabitEthernet1/0/1] port link-mode bridge

[SwitchA-GigabitEthernet1/0/1] service-instance 1000

[SwitchA-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

[SwitchA-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

# Create ACL 3000 to permit packets with source IP address 10.1.1.10 and destination IP address 10.1.1.20.

<SwitchA> system-view

[SwitchA] acl advanced 3000

[SwitchA-acl-ipv4-adv-3000] rule 0 permit ip source 10.1.1.10 0 destination 10.1.1.20 0

# Create node 0, use ACL 3000 to match packets with source IP address 10.1.1.1 and destination IP address 10.1.1.20. Apply next hop 10.1.1.11 and service chain path ID 1 to matching packets.

[SwitchA] policy-based-route aa permit node 0

[SwitchA-pbr-aa-0] if-match acl 3000

[SwitchA-pbr-aa-0] apply service-chain path-id 1

[SwitchA-pbr-aa-0] apply next-hop vpn-instance vpna 10.1.1.11

# Apply policy aa to VSI-interface 3.

[SwitchA] interface vsi-interface 1

[SwitchA-Vsi-interface1] ip policy-based-route aa

[SwitchA-Vsi-interface1] quit

3. Configure Switch B:

# Enable L2VPN.

<SwitchB> system-view

[SwitchB] l2vpn enable

# Disable remote-MAC address learning and remote ARP learning.

[SwitchB] vxlan tunnel mac-learning disable

[SwitchB] vxlan tunnel arp-learning disable

# Create an EVPN instance in VSI instance view, and configure the system to automatically generate an RT and RD.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] evpn encapsulation vxlan

[SwitchB-vsi-vpna-evpn-vxlan] route-distinguisher auto

[SwitchB-vsi-vpna-evpn-vxlan] vpn-target auto

[SwitchB-vsi-vpna-evpn-vxlan] quit

# Configure VXLAN 10.

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Configure BGP to advertise EVPN routes.

[SwitchB] bgp 200

[SwitchB-bgp-default] peer 4.4.4.4 as-number 200

[SwitchB-bgp-default] peer 4.4.4.4 connect-interface loopback0

[SwitchB-bgp-default] address-family l2vpn evpn

[SwitchB-bgp-default-evpn] peer 4.4.4.4 enable

# Create VPN instance vpna.

[SwitchB] ip vpn-instance vpna

[SwitchB-vpn-instance-vpna] route-distinguisher 1:1

[SwitchB-vpn-instance-vpna] address-family ipv4

[SwitchB-vpn-ipv4-vpna] vpn-target 2:2

[SwitchB-vpn-ipv4-vpna] quit

[SwitchB-vpn-instance-vpna] address-family evpn

[SwitchB-vpn-evpn-vpna] vpn-target 1:1

[SwitchB-vpn-evpn-vpna] quit

[SwitchB-vpn-instance-vpna] quit

# Configure VSI-interface 1.

[SwitchB] interface vsi-interface 1

[SwitchB-Vsi-interface1] ip binding vpn-instance vpna

[SwitchB-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[SwitchB-Vsi-interface1] mac-address 0001-0001-0001

[SwitchB-Vsi-interface1] local-proxy-arp enable

[SwitchB-Vsi-interface1] distributed-gateway local

[SwitchB-Vsi-interface1] quit

# Associate VSI instance vpna with VSI-interface 1.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] gateway vsi-interface 1

[SwitchB-vsi-vpna] quit

# Configure VSI-interface 3.

[SwitchB] interface vsi-interface 3

[SwitchB-Vsi-interface3] ip binding vpn-instance vpna

[SwitchB-Vsi-interface3] l3-vni 1000

[SwitchB-Vsi-interface3] quit

# Configure GigabitEthernet 1/0/1 as an AC interface.

[SwitchB] interface gigabitethernet 1/0/1

[SwitchB-GigabitEthernet1/0/1] port link-mode bridge

[SwitchB-GigabitEthernet1/0/1] service-instance 1000

[SwitchB-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 2

[SwitchB-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchB-GigabitEthernet1/0/1-srv1000] quit

[SwitchB-GigabitEthernet1/0/1] quit

# Create node 0 and apply next hop 10.1.1.11 to packets with service chain path ID 1.

[SwitchB] policy-based-route aa permit node 0

[SwitchB-pbr-aa-0] if-match service-chain path-id 1

[SwitchB-pbr-aa-0] apply next-hop vpn-instance vpna 10.1.1.11

[SwitchB-pbr-aa-0] quit

# Apply policy aa to VSI-interface 3.

[SwitchB] interface vsi-interface 3

[SwitchB-Vsi-interface3] ip policy-based-route aa

[SwitchB-Vsi-interface3] quit

4. Configure Switch C:

# Enable L2VPN.

<SwitchC> system-view

[SwitchC] l2vpn enable

# Disable remote-MAC address learning and remote ARP learning.

[SwitchC] vxlan tunnel mac-learning disable

[SwitchC] vxlan tunnel arp-learning disable

# Create an EVPN instance in VSI instance view, and configure the system to automatically generate an RT and RD.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] evpn encapsulation vxlan

[SwitchC-vsi-vpna-evpn-vxlan] route-distinguisher auto

[SwitchC-vsi-vpna-evpn-vxlan] vpn-target auto

[SwitchC-vsi-vpna-evpn-vxlan] quit

# Configure VXLAN 10.

[SwitchC-vsi-vpna] vxlan 10

[SwitchC-vsi-vpna-vxlan-10] quit

[SwitchC-vsi-vpna] quit

# Configure BGP to advertise EVPN routes.

[SwitchC] bgp 200

[SwitchC-bgp-default] peer 4.4.4.4 as-number 200

[SwitchC-bgp-default] peer 4.4.4.4 connect-interface loopback 0

[SwitchC-bgp-default] address-family l2vpn evpn

[SwitchC-bgp-default-evpn] peer 4.4.4.4 enable

[SwitchC-bgp-default-evpn] quit

[SwitchC-bgp-default] quit

# Create VPN instance vpna.

[SwitchC] ip vpn-instance vpna

[SwitchC-vpn-instance-vpna] route-distinguisher 1:1

[SwitchC-vpn-instance-vpna] address-family ipv4

[SwitchC-vpn-ipv4-vpna] vpn-target 2:2

[SwitchC-vpn-ipv4-vpna] quit

[SwitchC-vpn-instance-vpna] address-family evpn

[SwitchC-vpn-evpn-vpna] vpn-target 1:1

[SwitchC-vpn-evpn-vpna] quit

[SwitchC-vpn-instance-vpna] quit

# Create VSI-interface 1, assign an IP address to it, and specify the interface as a distributed gateway in VXLAN 10.

[SwitchC] interface vsi-interface 1

[SwitchC-Vsi-interface1] ip binding vpn-instance vpna

[SwitchC-Vsi-interface1] ip address 10.1.1.1 255.255.255.0

[SwitchC-Vsi-interface1] mac-address 0001-0001-0001

[SwitchC-Vsi-interface1] local-proxy-arp enable

[SwitchC-Vsi-interface1] distributed-gateway local

[SwitchC-Vsi-interface1] quit

# Create VSI-interface 3, associate the interface with VPN instance vpna, and set the L3 VXLAN ID to 1000.

[SwitchC] interface vsi-interface 3

[SwitchC-Vsi-interface3] ip binding vpn-instance vpna

[SwitchC-Vsi-interface3] l3-vni 1000

[SwitchC-Vsi-interface3] quit

# Associate VSI instance vpna with VSI-interface 1.

[SwitchC] vsi vpna

[SwitchC-vsi-vpna] gateway vsi-interface 1

[SwitchC-vsi-vpna] quit

# Bind VSI instance vpna to GigabitEthernet 1/0/1.

[SwitchC] interface gigabitethernet 1/0/1

[SwitchC-GigabitEthernet1/0/1] port link-mode bridge

[SwitchC-GigabitEthernet1/0/1] service-instance 2000

[SwitchC-GigabitEthernet1/0/1-srv2000] encapsulation s-vid 2

[SwitchC-GigabitEthernet1/0/1] xconnect vsi vpna

[SwitchC-GigabitEthernet1/0/1] quit

5. Configure Switch D:

# Configure Switch D to establish BGP connections with the other switches.

<SwitchD> system-view

[SwitchD] bgp 200

[SwitchD-bgp-default] group evpn

[SwitchD-bgp-default] peer 1.1.1.1 group evpn

[SwitchD-bgp-default] peer 2.2.2.2 group evpn

[SwitchD-bgp-default] peer 3.3.3.3 group evpn

[SwitchD-bgp-default] peer evpn as-number 200

[SwitchD-bgp-default] peer evpn connect-interface loopback 0

# Configure BGP to advertise EVPN routes, and disable route target filtering for BGP EVPN routes.

[SwitchD-bgp-default] address-family l2vpn evpn

[SwitchD-bgp-default-evpn] peer evpn enable

[SwitchD-bgp-default-evpn] undo policy vpn-target

# Configure Switch D as a route reflector.

[SwitchD-bgp-default-evpn] peer evpn reflect-client

[SwitchD-bgp-default-evpn] quit

[SwitchD-bgp-default] quit

# Configure VLAN-interface 11.

[SwitchD] interface vlan-interface 11

[SwitchD-Vlan-interface11] ip address 11.1.1.4 255.255.255.0

[SwitchD-Vlan-interface11] ospf 1 area 0.0.0.0

[SwitchD-Vlan-interface11] quit

# Configure VLAN-interface 12.

[SwitchD] interface vlan-interface 12

[SwitchD-Vlan-interface12] ip address 12.1.1.4 255.255.255.0

[SwitchD-Vlan-interface12] ospf 1 area 0.0.0.0

[SwitchD-Vlan-interface12] quit

# Configure VLAN-interface 13.

[SwitchD] interface Vlan-interface 13

[SwitchD-Vlan-interface13] ip address 13.1.1.4 255.255.255.0

[SwitchD-Vlan-interface13] ospf 1 area 0.0.0.0

[SwitchD-Vlan-interface13] quit

Verifying the configuration

# Capture packets sent from Server 1 to Server 2 in Ethernet service instance 1000. (Details not shown.)

The packets are processed by Service node 1 before they are delivered to Server 2.

06-Layer 3 - IP Routing Configuration Guide

Overview

if-match clause

apply clause

Relationship between the match mode and clauses on the node

PBR and Track

Configuring a policy

Creating a node

Setting match criteria for a node

Configuring actions for a node

Configuring PBR

Displaying and maintaining PBR

PBR configuration examples

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Network requirements

Configuration procedure

Verifying the configuration

Cloud & AI

InterConnect

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Resources

Partner Business Management

Company Information

News & Events

Contact Us