Contents

Configuring IPv6 PBR· 1

Overview·· 1

Policy· 1

PBR and Track· 2

IPv6 PBR configuration task list 2

Configuring an IPv6 policy· 3

Creating an IPv6 node· 3

Setting match criteria for an IPv6 node· 3

Configuring actions for an IPv6 node· 3

Configuring IPv6 PBR·· 4

Configuring IPv6 local PBR·· 4

Configuring IPv6 interface PBR·· 4

Displaying and maintaining IPv6 PBR·· 4

IPv6 PBR configuration examples· 5

Packet type-based IPv6 local PBR configuration example· 5

Packet type-based IPv6 interface PBR configuration example· 6

Configuring IPv6 PBR

Overview

Policy-based routing (PBR) uses user-defined policies to route packets. A policy can specify the next hop for packets that match specific criteria such as ACLs.

A device forwards received packets using the following process:

1.     The device uses PBR to forward matching packets.

2.     If the packets do not match the PBR policy or the PBR-based forwarding fails, the device uses the routing table, excluding the default route, to forward the packets.

3.     If the routing table-based forwarding fails, the device uses the default route to forward packets.

PBR includes local PBR and interface PBR.

·     Local PBR guides the forwarding of locally generated packets, such as the ICMP packets generated by using the ping command.

·     Interface PBR guides the forwarding of packets received on an interface only.

Policy

An IPv6 policy includes match criteria and actions to be taken on the matching packets. A policy can have one or multiple nodes as follows:

·     Each node is identified by a node number. A smaller node number has a higher priority.

·     A node contains if-match and apply clauses. An if-match clause specifies a match criterion, and an apply clause specifies an action.

·     A node has a match mode of permit or deny.

An IPv6 policy compares packets with nodes in priority order. If a packet matches the criteria on a node, it is processed by the action on the node. If the packet does not match any criteria on the node, it goes to the next node for a match. If the packet does not match the criteria on any node, it is forwarded according to the routing table.

if-match clause

IPv6 PBR supports the if-match acl clause, which sets an ACL match criterion.

You can specify only one if-match clause for each node.

apply clause

IPv6 PBR supports the types of apply clauses shown in Table 1. You can specify multiple apply clauses for a node, but some of them might not be executed. The following apply clauses determine the packet forwarding paths in a descending order:

·     apply next-hop

·     apply output-interface

Table 1 Priorities and meanings of apply clauses

Clause	Meaning	Priority
apply precedence	Sets an IP precedence.	This clause is always executed.
apply next-hop and apply output-interface	Sets next hops and sets output interfaces.	Only the apply next-hop clause is executed when both are configured.

 

Relationship between the match mode and clauses on the node

Does a packet match all the if-match clauses on the node?	Match mode
	In permit mode	In deny mode
Yes	·     If the node contains apply clauses, IPv6 PBR executes the apply clauses on the node. ¡     If the IPv6 PBR-based forwarding succeeds, IPv6 PBR does not compare the packet with the next node. ¡     If the IPv6 PBR-based forwarding fails, IPv6 PBR does not compare the packet with the next node. ·     If the node does not contain apply clauses, the packet is forwarded according to the routing table.	The packet is forwarded according to the routing table.
No	IPv6 PBR compares the packet with the next node.	IPv6 PBR compares the packet with the next node.

 

A node that has no if-match clauses matches any packet.

PBR and Track

PBR can work with the Track feature to dynamically adapt the availability status of an apply clause to the link status of a tracked next hop.

·     When the track entry associated with an object changes to Negative, the apply clause is invalid.

·     When the track entry changes to Positive or NotReady, the apply clause is valid.

For more information about Track-PBR collaboration, see High Availability Configuration Guide.

IPv6 PBR configuration task list

Tasks at a glance
(Required.) Configuring an IPv6 policy: ·     Creating an IPv6 node ·     Setting match criteria for an IPv6 node ·     Configuring actions for an IPv6 node
(Required.) Configuring IPv6 PBR: ·     Configuring IPv6 local PBR ·     Configuring IPv6 interface PBR

 

Configuring an IPv6 policy

Creating an IPv6 node

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Create an IPv6 policy or policy node, and enter IPv6 policy node view.	ipv6 policy-based-route policy-name [ deny | permit ] node node-number	By default, no IPv6 policy node is created.
3.     (Optional.) Configure a description for the IPv6 policy node.	description text	By default, no description is configured for the IPv6 policy node.

 

Setting match criteria for an IPv6 node

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter IPv6 policy node view.	ipv6 policy-based-route policy-name [ deny | permit ] node node-number	N/A
3.     Set an ACL match criterion.	if-match acl { ipv6-acl-number | name ipv6-acl-name }	By default, no ACL match criterion is set. If an ACL match criterion is defined, packets are compared with the ACL rules, and the permit or deny action and the time range of the specified ACL are ignored. If the specified ACL does not exist, no packet is matched.

 

Configuring actions for an IPv6 node

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter IPv6 policy node view.	ipv6 policy-based-route policy-name [ deny | permit ] node node-number	N/A
3.     Set an IP precedence.	apply precedence { type | value }	By default, no IP precedence is specified.
4.     Set next hops for permitted IPv6 packets.	apply next-hop [ vpn-instance vpn-instance-name ] { ipv6-address [ direct ] [ track track-entry-number ] }&<1-2>	By default, no next hop is specified. You can specify two next hops for backup by executing this command twice.
5.     Set output interfaces.	apply output-interface { interface-type interface-number  [ track track-entry-number ] }	By default, no output interface is specified.

 

Configuring IPv6 PBR

Configuring IPv6 local PBR

Configure IPv6 PBR by applying a policy locally. IPv6 PBR uses the policy to guide the forwarding of locally generated packets. The specified policy must already exist. If the policy does not exist, the IPv6 local PBR configuration fails.

You can apply only one policy locally. Before you apply a new policy, you must first remove the current policy.

IPv6 local PBR might affect local services, such as ping and Telnet. Do not configure IPv6 local PBR unless doing so is required.

To configure IPv6 local PBR:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Apply a policy locally.	ipv6 local policy-based-route policy-name	By default, no policy is locally applied.

 

Configuring IPv6 interface PBR

Configure IPv6 PBR by applying an IPv6 policy to an interface. IPv6 PBR uses the policy to guide the forwarding of IPv6 packets received on the interface. The specified policy must already exist. If the policy does not exist, the IPv6 interface PBR configuration fails.

You can apply only one policy to an interface. Before you apply a new policy, you must first remove the current policy from the interface.

You can apply a policy to multiple interfaces.

To configure IPv6 interface PBR:

 

Step	Command	Remarks
1.     Enter system view.	system-view	N/A
2.     Enter interface view.	interface interface-type interface-number	N/A
3.     Apply an IPv6 policy to the interface.	ipv6 policy-based-route policy-name	By default, no IPv6 policy is applied to the interface.

 

Displaying and maintaining IPv6 PBR

Execute display commands in any view and reset commands in user view.

 

Task	Command
Display IPv6 PBR policy information.	display ipv6 policy-based-route [ policy policy-name ]
Display IPv6 PBR configuration.	display ipv6 policy-based-route setup
(In standalone mode.) Display IPv6 local PBR configuration and statistics.	display ipv6 policy-based-route local [ slot slot-number ]
(In IRF mode.) Display IPv6 local PBR configuration and statistics.	display ipv6 policy-based-route local [ chassis chassis-number slot slot-number ]
(In standalone mode.) Display IPv6 interface PBR configuration and statistics.	display ipv6 policy-based-route interface interface-type interface-number [ slot slot-number ]
(In IRF mode.) Display IPv6 interface PBR configuration and statistics.	display ipv6 policy-based-route interface interface-type interface-number [ chassis chassis-number slot slot-number ]
Clear IPv6 PBR statistics.	reset ipv6 policy-based-route statistics [ policy policy-name ]

 

IPv6 PBR configuration examples

Packet type-based IPv6 local PBR configuration example

Network requirements

As shown in Figure 1, configure IPv6 PBR on Switch A to forward all TCP packets to the next hop 1::2. Switch A forwards other packets according to the routing table.

Figure 1 Network diagram

 

Configuration procedure

1.     Configure Switch A:

# Create VLAN 10 and VLAN 20.

<SwitchA> system-view

[SwitchA] vlan 10

[SwitchA-vlan10] quit

[SwitchA] vlan 20

[SwitchA-vlan20] quit

# Configure the IPv6 addresses of VLAN-interface 10 and VLAN-interface 20.

[SwitchA] interface vlan-interface 10

[SwitchA-Vlan-interface10] ipv6 address 1::1 64

[SwitchA-Vlan-interface10] quit

[SwitchA] interface vlan-interface 20

[SwitchA-Vlan-interface20] ipv6 address 2::1 64

[SwitchA-Vlan-interface20] quit

# Configure ACL 3001 to match TCP packets.

[SwitchA] acl ipv6 advanced 3001

[SwitchA-acl-ipv6-adv-3001] rule permit tcp

[SwitchA-acl-ipv6-adv-3001] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1::2.

[SwitchA] ipv6 policy-based-route aaa permit node 5

[SwitchA-pbr6-aaa-5] if-match acl 3001

[SwitchA-pbr6-aaa-5] apply next-hop 1::2

[SwitchA-pbr6-aaa-5] quit

# Configure IPv6 local PBR by applying policy aaa to Switch A.

[SwitchA] ipv6 local policy-based-route aaa

2.     Configure Switch B:

# Create VLAN 10.

<SwitchB> system-view

[SwitchB] vlan 10

[SwitchB-vlan10] quit

# Configure the IPv6 address of VLAN-interface 10.

[SwitchB] interface vlan-interface 10

[SwitchB-Vlan-interface10] ipv6 address 1::2 64

3.     Configure Switch C:

# Create VLAN 20.

<SwitchC> system-view

[SwitchC] vlan 20

[SwitchC-vlan20] quit

# Configure the IPv6 address of VLAN-interface 20.

[SwitchC] interface vlan-interface 20

[SwitchC-Vlan-interface20] ipv6 address 2::2 64

Verifying the configuration

# Telnet to Switch B on Switch A. The operation succeeds.

# Telnet to Switch C on Switch A. The operation fails.

# Ping Switch C from Switch A. The operation succeeds.

Telnet uses TCP and ping uses ICMP. The results show the following:

·     All TCP packets sent from Switch A are forwarded to the next hop 1::2.

·     Other packets are forwarded through VLAN-interface 20.

·     The IPv6 local PBR configuration is effective.

Packet type-based IPv6 interface PBR configuration example

Network requirements

As shown in Figure 2, configure IPv6 PBR on Switch A to forward all TCP packets received on VLAN-interface 11 to the next hop 1::2. Switch A forwards other IPv6 packets according to the routing table.

Figure 2 Network diagram

 

Configuration procedure

1.     Configure Switch A:

# Create VLAN 10 and VLAN 20.

<SwitchA> system-view

[SwitchA] vlan 10

[SwitchA-vlan10] quit

[SwitchA] vlan 20

[SwitchA-vlan20] quit

# Configure RIPng.

[SwitchA] ripng 1

[SwitchA-ripng-1] quit

[SwitchA] interface vlan-interface 10

[SwitchA-Vlan-interface10] ipv6 address 1::1 64

[SwitchA-Vlan-interface10] ripng 1 enable

[SwitchA-Vlan-interface10] quit

[SwitchA] interface vlan-interface 20

[SwitchA-Vlan-interface20] ipv6 address 2::1 64

[SwitchA-Vlan-interface20] ripng 1 enable

[SwitchA-Vlan-interface20] quit

# Configure ACL 3001 to match TCP packets.

[SwitchA] acl ipv6 advanced 3001

[SwitchA-acl-ipv6-adv-3001] rule permit tcp

[SwitchA-acl-ipv6-adv-3001] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1::2.

[SwitchA] ipv6 policy-based-route aaa permit node 5

[SwitchA-pbr6-aaa-5] if-match acl 3001

[SwitchA-pbr6-aaa-5] apply next-hop 1::2

[SwitchA-pbr6-aaa-5] quit

# Configure IPv6 interface PBR by applying policy aaa to VLAN-interface 11.

[SwitchA] interface vlan-interface 11

[SwitchA-Vlan-interface11] ipv6 address 10::2 64

[SwitchA-Vlan-interface11] undo ipv6 nd ra halt

[SwitchA-Vlan-interface11] ripng 1 enable

[SwitchA-Vlan-interface11] ipv6 policy-based-route aaa

2.     Configure Switch B:

# Create VLAN 10.

<SwitchB> system-view

[SwitchB] vlan 10

[SwitchB-vlan10] quit

# Configure RIPng.

[SwitchB] ripng 1

[SwitchB-ripng-1] quit

[SwitchB] interface vlan-interface 10

[SwitchB-Vlan-interface10] ipv6 address 1::2 64

[SwitchB-Vlan-interface10] ripng 1 enable

[SwitchB-Vlan-interface10] quit

3.     Configure Switch C:

# Create VLAN 20.

<SwitchC> system-view

[SwitchC] vlan 20

[SwitchC-vlan20] quit

# Configure RIPng.

[SwitchC] ripng 1

[SwitchC-ripng-1] quit

[SwitchC] interface vlan-interface 20

[SwitchC-Vlan-interface20] ipv6 address 2::2 64

[SwitchC-Vlan-interface20] ripng 1 enable

[SwitchC-Vlan-interface20] quit

Verifying the configuration

# Enable IPv6 and configure the IPv6 address 10::3 for Host A.

C:\>ipv6 install

Installing...

Succeeded.

C:\>ipv6 adu 4/10::3

# On Host A, Telnet to Switch B that is directly connected to Switch A. The operation succeeds.

# On Host A, Telnet to Switch C that is directly connected to Switch A. The operation fails.

# Ping Switch C from Host A. The operation succeeds.

Telnet uses TCP, and ping uses ICMP. The results show the following:

·     All TCP packets arriving on VLAN-interface 11 of Switch A are forwarded to next hop 1::2.

·     Other packets are forwarded through VLAN-interface 20.

·     The IPv6 interface PBR configuration is effective.