Contents

Configuring PBR· 1

Overview·· 1

Policy· 1

PBR and Track· 2

PBR configuration task list 2

Configuring a policy· 2

Creating a node· 2

Setting match criteria for a node· 3

Configuring actions for a node· 3

Configuring PBR·· 4

Configuring local PBR·· 4

Configuring interface PBR·· 4

Configuring interface outbound PBR·· 5

Enabling VXLAN mode for PBR·· 5

Displaying and maintaining PBR·· 5

PBR configuration examples· 6

Packet type-based local PBR configuration example· 6

Packet type-based interface PBR configuration example· 7

VXLAN ID-based interface outbound PBR configuration example· 9

Configuring PBR

Overview

Policy-based routing (PBR) uses user-defined policies to route packets. A policy can specify the next hop and other parameters for packets that match specific criteria such as ACLs.

A device forwards received packets using the following process:

1.        The device uses PBR to forward matching packets.

2.        If the packets do not match the PBR policy or the PBR-based forwarding fails, the device uses the routing table, excluding the default route, to forward the packets.

3.        If the routing table-based forwarding fails, the device uses the default next hop or default output interface defined in PBR to forward packets.

4.        If the default next hop or default output interface-based forwarding fails, the device uses the default route to forward packets.

PBR includes the following types:

·          Local PBR—Guides the forwarding of locally generated packets, such as the ICMP packets generated by using the ping command.

·          Interface PBR—Guides the forwarding of packets received on an interface only.

·          Interface outbound PBR—Guides the forwarding of outgoing packets through a route when equal-cost routes exist.

Policy

A policy comprises match criteria and actions to be taken on the matching packets. A policy can have one or multiple nodes as follows:

·          Each node is identified by a node number. A smaller node number has a higher priority.

·          A node comprises if-match and apply clauses. An if-match clause specifies a match criterion, and an apply clause specifies an action.

·          A node has a match mode of permit or deny.

A policy matches nodes in priority order against packets. If a packet matches the criteria on a node, it is processed by the action on the node. Otherwise, it goes to the next node for a match. If the packet does not match the criteria on any node, it is forwarded according to the routing table.

if-match clause

PBR supports the following types of clauses:

·          if-match acl—Sets the ACL match criterion.

·          if-match vxlan-id—Sets the VXLAN match criterion. For more information about VXLAN, see VXLAN Configuration Guide.

apply clause

PBR supports the following types of apply clauses listed in a descending priority order:

·          apply next-hop

·          apply output-interface NULL 0

·          apply default-next-hop

You can specify multiple apply clauses for a node.

Relationship between the match mode and clauses on the node

Does a packet match all the if-match clauses on the node?	Match mode
	Permit	Deny
Yes.	·         If the node is configured with apply clauses, PBR executes the apply clauses on the node. PBR does not match the packet against the next node. ·         If the node is configured with no apply clause, the packet is forwarded according to the routing table.	The packet is forwarded according to the routing table.
No.	PBR matches the packet against the next node.	PBR matches the packet against the next node.

 

A node that has no if-match clauses matches any packet.

PBR and Track

PBR can work with the Track feature to dynamically adapt the availability status of an apply clause to the link status of a tracked next hop:

·          When the track entry associated with an object changes to Negative, the apply clause is invalid.

·          When the track entry changes to Positive or NotReady, the apply clause is valid.

For more information about Track-PBR collaboration, see High Availability Configuration Guide.

PBR configuration task list

Tasks at a glance
(Required.) Configuring a policy: ·         Creating a node ·         Setting match criteria for a node ·         Configuring actions for a node
(Required.) Configuring PBR: ·         Configuring local PBR ·         Configuring interface PBR ·         Configuring interface outbound PBR
(Optional.) Enabling VXLAN mode for PBR

 

Configuring a policy

Creating a node

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Create a node for a policy, and enter policy node view.	policy-based-route policy-name [ deny | permit ] node node-number	By default, no policy node is created.

 

Setting match criteria for a node

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enter policy node view.	policy-based-route policy-name [ deny | permit ] node node-number	N/A
3.       Set an ACL match criterion.	if-match acl acl-number{ acl-number | name acl-name }	By default, no ACL match criterion is set.
4.       Configure a VXLAN match criterion.	if-match vxlan-id vxlan-id	By default, no VXLAN match criterion is configured. Use this command only when you configure PBR for a VXLAN network. In a VXLAN, devices in the transport network forwards VXLAN packets only based on the destination IP addresses of the packets. You must configure interface PBR on a Layer 3 interface. The PBR can use this match criterion to match VXLAN IDs in outgoing packets. In a VXLAN, equal-cost routes might exist on the VXLAN IP gateway's outgoing tunnel interface. You must configure interface outbound PBR on the outgoing tunnel interface. The PBR can use this match criterion to match VXLAN IDs used for replacing the original VXLAN IDs in outgoing packets.

 

	NOTE: If an ACL match criterion is defined, packets are matched against the ACL rules, and the permit or deny action and the time range of the specified ACL are ignored. If the specified ACL does not exist, no packet is matched.

 

Configuring actions for a node

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enter policy node view.	policy-based-route policy-name [ deny | permit ] node node-number	N/A
3.       Set next hops.	apply next-hop [ vpn-instance vpn-instance-name ] { ip-address [ direct ] [ track track-entry-number ] }&<1-n>	By default, no next hop is specified. You can specify two next hops for backup in one command line or by executing this command twice. You can specify a maximum of two next hops for a node.
4.       Set default next hops.	apply default-next-hop [ vpn-instance vpn-instance-name ] { ip-address [ direct ] [ track track-entry-number ] }&<1-n>	By default, no default next hop is specified. You can specify two default next hops for backup in one command line or by executing this command twice. You can specify a maximum of two default next hops for a node.
5.       Set the output interface to interface Null 0.	apply output-interface NULL 0 [ track track-entry-number ]	By default, the output interface is not set to interface Null 0.

 

Configuring PBR

Configuring local PBR

Configure PBR by applying a policy locally. PBR uses the policy to guide the forwarding of locally generated packets. The specified policy must already exist. Otherwise, the local PBR configuration fails.

You can apply only one policy locally. Before you apply a new policy, you must first remove the current policy.

Do not configure local PBR unless required.

To configure local PBR:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Apply a policy locally.	ip local policy-based-route policy-name	By default, no policy is locally applied.

 

Configuring interface PBR

Configure PBR by applying a policy to an interface. PBR uses the policy to guide the forwarding of packets received on the interface. The specified policy must already exist. Otherwise, the interface PBR configuration fails.

You can apply only one policy to an interface. Before you apply a new policy, you must first remove the current policy from the interface.

You can apply a policy to multiple interfaces.

To configure interface PBR:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enter interface view.	interface interface-type interface-number	N/A
3.       Apply a policy to the interface.	ip policy-based-route policy-name	By default, no policy is applied to the interface.

 

Configuring interface outbound PBR

In a VXLAN network, equal-cost routes might exist between two endpoints of a VXLAN tunnel. The device cannot route VXLAN packets to the exact next hop. This feature allows you to configure PBR on a VXLAN tunnel interface to guide the outgoing VXLAN packets.

Interface outbound PBR takes effect only on the VXLAN IP gateway.

You can apply only one policy to an interface. Before you apply a new policy, you must first remove the existing policy from the interface.

To configure interface outbound PBR:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Create a VXLAN tunnel interface and enter tunnel interface view.	interface tunnel tunnel-number mode vxlan	By default, no tunnel interfaces exist. The endpoints of a tunnel must use the same tunnel mode to correctly transmit packets.
3.       Apply a policy to the interface for guiding outgoing packets.	ip policy-based-route policy-name egress	By default, no policy is applied to the interface for guiding outgoing packets.

 

Enabling VXLAN mode for PBR

The hardware resources provided for VXLAN networks and non-VXLAN networks are different. This feature enables PBR to forward matching IP packets into VXLAN networks. For more information about VXLAN, see VXLAN Configuration Guide.

To enable VXLAN mode for PBR:

 

Step	Command	Remarks
1.       Enter system view.	system-view	N/A
2.       Enable VXLAN mode for PBR.	ip policy-based-route vxlan-mode enable	By default, VXLAN mode for PBR is disabled.

 

Displaying and maintaining PBR

Execute display commands in any view and reset commands in user view.

 

Task	Command
Display PBR policy information.	display ip policy-based-route [ policy policy-name ]
Display interface outbound PBR configuration and statistics (in standalone mode).	display ip policy-based-route egress interface interface-type interface-number [ slot slot-number ]
Display interface outbound PBR configuration and statistics (in IRF mode).	display ip policy-based-route egress interface interface-type interface-number [ chassis chassis-number slot slot-number ]
Display PBR configuration.	display ip policy-based-route setup
Display local PBR configuration and statistics (in standalone mode).	display ip policy-based-route local [ slot slot-number ]
Display local PBR configuration and statistics (in IRF mode).	display ip policy-based-route local [ chassis chassis-number slot slot-number ]
Display interface PBR configuration and statistics (in standalone mode).	display ip policy-based-route interface interface-type interface-number [ slot slot-number ]
Display interface PBR configuration and statistics (in IRF mode).	display ip policy-based-route interface interface-type interface-number [ chassis chassis-number slot slot-number ]
Clear PBR statistics.	reset ip policy-based-route statistics [ policy policy-name ]

 

PBR configuration examples

Packet type-based local PBR configuration example

Network requirements

As shown in Figure 1, Swith B and Switch C are connected through Switch A. Swith B and Switch C do not have a route to reach each other. Configure PBR on Switch A to forward all TCP packets to the next hop 1.1.2.2. Switch A forwards other packets according to the routing table.

Figure 1 Network diagram

 

Configuration procedure

1.        Configure Switch A:

# Create VLAN 10 and VLAN 20.

<SwitchA> system-view

[SwitchA] vlan 10

[SwitchA-vlan10] quit

[SwitchA] vlan 20

[SwitchA-vlan20] quit

# Configure the IP addresses of VLAN-interface 10 and VLAN-interface 20.

[SwitchA] interface vlan-interface 10

[SwitchA-Vlan-interface10] ip address 1.1.2.1 24

[SwitchA-Vlan-interface10] quit

[SwitchA] interface vlan-interface 20

[SwitchA-Vlan-interface20] ip address 1.1.3.1 24

[SwitchA-Vlan-interface20] quit

# Configure ACL 3101 to match TCP packets.

[SwitchA] acl number 3101

[SwitchA-acl-adv-3101] rule permit tcp

[SwitchA-acl-adv-3101] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1.1.2.2.

[SwitchA] policy-based-route aaa permit node 5

[SwitchA-pbr-aaa-5] if-match acl 3101

[SwitchA-pbr-aaa-5] apply next-hop 1.1.2.2

[SwitchA-pbr-aaa-5] quit

# Configure local PBR by applying policy aaa to Switch A.

[SwitchA] ip local policy-based-route aaa

2.        Configure Switch B:

# Create VLAN 10.

<SwitchB> system-view

[SwitchB] vlan 10

[SwitchB-vlan10] quit

# Configure the IP address of VLAN-interface 10.

[SwitchB] interface vlan-interface 10

[SwitchB-Vlan-interface10] ip address 1.1.2.2 24

3.        Configure Switch C:

# Create VLAN 20.

<SwitchC> system-view

[SwitchC] vlan 20

[SwitchC-vlan20] quit

# Configure the IP address of VLAN-interface 20.

[SwitchC] interface vlan-interface 20

[SwitchC-Vlan-interface20] ip address 1.1.3.2 24

Verifying the configuration

# Telnet to Switch B on Switch A. The operation succeeds.

# Telnet to Switch C on Switch A. The operation fails.

# Ping Switch C from Switch A. The operation succeeds.

Telnet uses TCP and ping uses ICMP. The preceding results show that all TCP packets sent from Switch A are forwarded to the next hop 1.1.2.2, and other packets are forwarded through VLAN-interface 20. The local PBR configuration is effective.

Packet type-based interface PBR configuration example

Network requirements

As shown in Figure 2, Switch B and Switch C do not have a route to reach each other. Configure PBR on Switch A to forward all TCP packets received on VLAN-interface 11 to the next hop 1.1.2.2. Switch A forwards other packets according to the routing table.

Figure 2 Network diagram

 

Configuration procedure

1.        Configure Switch A:

# Create VLAN 10 and VLAN 20.

<SwitchA> system-view

[SwitchA] vlan 10

[SwitchA-vlan10] quit

[SwitchA] vlan 20

[SwitchA-vlan20] quit

# Configure the IP addresses of VLAN-interface 10 and VLAN-interface 20.

[SwitchA] interface vlan-interface 10

[SwitchA-Vlan-interface10] ip address 1.1.2.1 24

[SwitchA-Vlan-interface10] quit

[SwitchA] interface vlan-interface 20

[SwitchA-Vlan-interface20] ip address 1.1.3.1 24

[SwitchA-Vlan-interface20] quit

# Configure ACL 3101 to match TCP packets.

[SwitchA] acl number 3101

[SwitchA-acl-adv-3101] rule permit tcp

[SwitchA-acl-adv-3101] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1.1.2.2.

[SwitchA] policy-based-route aaa permit node 5

[SwitchA-pbr-aaa-5] if-match acl 3101

[SwitchA-pbr-aaa-5] apply next-hop 1.1.2.2

[SwitchA-pbr-aaa-5] quit

# Configure interface PBR by applying policy aaa to VLAN-interface 11.

[SwitchA] interface vlan-interface 11

[SwitchA-Vlan-interface11] ip address 10.110.0.10 24

[SwitchA-Vlan-interface11] ip policy-based-route aaa

[SwitchA-Vlan-interface11] quit

2.        Configure Switch B:

# Create VLAN 10.

<SwitchB> system-view

[SwitchB] vlan 10

[SwitchB-vlan10] quit

# Configure the IP address of VLAN-interface 10.

[SwitchB] interface vlan-interface 10

[SwitchB-Vlan-interface10] ip address 1.1.2.2 24

[SwitchB-Vlan-interface10] quit

# Configure a static route to subnet 10.110.0.0/24.

[SwitchB] ip route-static 10.110.0.0 24 1.1.2.1

3.        Configure Switch C:

# Create VLAN 20.

<SwitchC> system-view

[SwitchC] vlan 20

[SwitchC-vlan20] quit

# Configure the IP address of VLAN-interface 20.

[SwitchC] interface vlan-interface 20

[SwitchC-Vlan-interface20] ip address 1.1.3.2 24

[SwitchC-Vlan-interface20] quit

# Configure a static route to subnet 10.110.0.0/24.

[SwitchC] ip route-static 10.110.0.0 24 1.1.3.1

Verifying the configuration

# Configure the IP address 10.110.0.20/24 for Host A, and specify its gateway address as 10.110.0.10.

# On Host A, Telnet to Switch B that is directly connected to Switch A. The operation succeeds.

# On Host A, Telnet to Switch C that is directly connected to Switch A. The operation fails.

# Ping Switch C from Host A. The operation succeeds.

Telnet uses TCP and ping uses ICMP. The preceding results show that all TCP packets arriving on VLAN-interface 11 of Switch A are forwarded to next hop 1.1.2.2, and other packets are forwarded through VLAN-interface 20. The interface PBR configuration is effective.

VXLAN ID-based interface outbound PBR configuration example

Network requirements

As shown in Figure 3, Switch C and Switch D are Layer 3 switches in the transport network. VXLAN 10 is configured on Switch A and Switch B (as VTEPs) to provide Layer 2 connectivity for VM 1 and VM 2 across the network sites.

·          A VXLAN tunnel between the VTEPs is manually established.

·          The tunnel is assigned to the VXLAN.

·          Remote MAC address learning is enabled.

·          The VTEPs flood VXLAN traffic in unicast mode (head-end replication).

Traffic from VM 1 to VM 2 enters the VXLAN tunnel through one of the equal-cost routes (with the next hop 2.1.1.2) between the VXLAN endpoints.

Configure PBR for Tunnel 1 on Switch A to forward the outgoing traffic through the route with the next hop 1.1.1.2.

Figure 3 Network diagram

 

Configuration procedure

1.        Configure IP addresses and unicast routing settings:

# Assign IP address to interfaces, as shown in Figure 3. (Details not shown.)

# Configure OSPF on all switches in the transport network. (Details not shown.)

2.        Configure Switch A:

# Enable L2VPN.

<SwitchA> system-view

[SwitchA] l2vpn enable

# Enable Layer 2 forwarding for VXLANs.

[SwitchA] undo vxlan ip-forwarding

# Create the VSI vpna and VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnel.

[SwitchA] interface loopback 0

[SwitchA-Loopback0] ip address 6.6.6.6 255.255.255.255

[SwitchA-Loopback0] quit

# Create a VXLAN tunnel to Switch B. The tunnel interface is Tunnel 1. The tunnel destination is Loopback 0 at 8.8.8.8 on Switch B.

[SwitchA] interface tunnel 1 mode vxlan

[SwitchA-Tunnel1] source 6.6.6.6

[SwitchA-Tunnel1] destination 8.8.8.8

[SwitchA-Tunnel1] quit

# Assign Tunnel 1 to VXLAN 10.

[SwitchA] vsi vpna

[SwitchA-vsi-vpna] vxlan 10

[SwitchA-vsi-vpna-vxlan-10] tunnel 1

[SwitchA-vsi-vpna-vxlan-10] quit

[SwitchA-vsi-vpna] quit

# Create Ethernet service instance 1000 on GigabitEthernet 1/0/1 to match frames from VLAN 10.

[SwitchA] interface gigabitethernet 1/0/1

[SwitchA-GigabitEthernet1/0/1] service-instance 1000

[SwitchA-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 10

# Map Ethernet service instance 1000 to the VSI vpna.

[SwitchA-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchA-GigabitEthernet1/0/1-srv1000] quit

[SwitchA-GigabitEthernet1/0/1] quit

# Configure node 5 for the policy aaa, and configure a VXLAN match criterion for the policy to forward packets with the VXLAN ID 10 to 1.1.1.2.

[SwitchA] policy-based-route aaa permit node 5

[SwitchA-pbr-aaa-5] if-match vxlan 10

[SwitchA-pbr-aaa-5] apply next-hop 1.1.1.2

[SwitchA-pbr-aaa-5] quit

# Apply the policy to Tunnel 1 to guide the forwarding of outgoing packets.

[SwitchA] interface tunnel 1

[SwitchA-Tunnel1] ip policy-based-route aaa egress

[SwitchA-Tunnel1] quit

3.        Configure Switch B:

# Enable L2VPN.

<SwitchB> system-view

[SwitchB] l2vpn enable

# Enable Layer 2 forwarding for VXLANs.

[SwitchB] undo vxlan ip-forwarding

# Create the VSI vpna and VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Assign an IP address to Loopback 0. The IP address will be used as the source IP address of the VXLAN tunnel.

[SwitchB] interface loopback 0

[SwitchB-Loopback0] ip address 8.8.8.8 255.255.255.255

[SwitchB-Loopback0] quit

# Create a VXLAN tunnel to Switch A. The tunnel interface is Tunnel 1. The tunnel destination is Loopback 0 at 6.6.6.6 on Switch A.

[SwitchB] interface tunnel 1 mode vxlan

[SwitchB-Tunnel1] source 8.8.8.8

[SwitchB-Tunnel1] destination 6.6.6.6

[SwitchB-Tunnel1] quit

# Assign Tunnel 1 to VXLAN 10.

[SwitchB] vsi vpna

[SwitchB-vsi-vpna] vxlan 10

[SwitchB-vsi-vpna-vxlan-10] tunnel 1

[SwitchB-vsi-vpna-vxlan-10] quit

[SwitchB-vsi-vpna] quit

# Create Ethernet service instance 1000 on GigabitEthernet 1/0/1 to match frames from VLAN 10.

[SwitchB] interface gigabitethernet 1/0/1

[SwitchB-GigabitEthernet1/0/1] service-instance 1000

[SwitchB-GigabitEthernet1/0/1-srv1000] encapsulation s-vid 10

# Map Ethernet service instance 1000 to the VSI vpna.

[SwitchB-GigabitEthernet1/0/1-srv1000] xconnect vsi vpna

[SwitchB-GigabitEthernet1/0/1-srv1000] quit

[SwitchB-GigabitEthernet1/0/1] quit