05-Layer 3—IP Routing Configuration Guide

HomeSupportResource CenterSwitchesH3C IE Series Industrial Ethernet SwitchesH3C IE4300-12P-AC & IE4300-12P-PWR Industrial SwitchesTechincal DocumentsConfigureConfiguration GuidesH3C IE4300[IE4300-M] Switch Series Configuration Guides-R63xx-6W10005-Layer 3—IP Routing Configuration Guide
05-Policy-based routing configuration
Title Size Download
05-Policy-based routing configuration 120.23 KB

Configuring PBR

About PBR

Policy-based routing (PBR) uses user-defined policies to route packets. A policy can specify parameters for packets that match specific criteria such as ACLs. The parameters include the next hop.

Packet forwarding process

The device forwards received packets using the following process:

1.        The device uses PBR to forward matching packets.

2.        If one of the following events occurs, the device searches for a route (except the default route) in the routing table to forward packets:

¡  The packets do not match the PBR policy.

¡  The PBR-based forwarding fails.

3.        If the forwarding fails, the device uses the default route to forward packets.

PBR types

PBR includes the following types:

·          Local PBR—Guides the forwarding of locally generated packets, such as ICMP packets generated by using the ping command.

·          Interface PBR—Guides the forwarding of packets received on an interface.

Policy

A policy includes match criteria and actions to be taken on the matching packets. A policy can have one or multiple nodes as follows:

·          Each node is identified by a node number. A smaller node number has a higher priority.

·          A node contains if-match and apply clauses. An if-match clause specifies a match criterion, and an apply clause specifies an action.

·          A node has a match mode of permit or deny.

A policy compares packets with nodes in priority order. If a packet matches the criteria on a node, it is processed by the action on the node. If the packet does not match any criteria on the node, it goes to the next node for a match. If the packet does not match the criteria on any node, the device performs a routing table lookup.

Relationship between if-match clauses

PBR supports only the if-match acl clause to set an ACL match criterion. On a node, you can specify only one if-match clause.

Relationship between apply clauses

PBR supports only the apply next-hop clause to set next hops.

Relationship between the match mode and clauses on the node

Does a packet match all the if-match clauses on the node?

Match mode

Permit

Deny

Yes.

·         If the node contains apply clauses, PBR executes the apply clauses on the node. If PBR-based forwarding succeeds, PBR does not compare the packet with the next node.

·         If the node does not contain apply clauses, the device performs a routing table lookup for the packet.

The device performs a routing table lookup for the packet.

No.

PBR compares the packet with the next node.

PBR compares the packet with the next node.

 

NOTE:

A node that has no if-match clauses matches any packet.

PBR and Track

PBR can work with the Track feature to dynamically adapt the availability status of an apply clause to the link status of a tracked object. The tracked object can be a next hop.

·          When the track entry associated with an object changes to Negative, the apply clause is invalid.

·          When the track entry changes to Positive or NotReady, the apply clause is valid.

For more information about Track and PBR collaboration, see High Availability Configuration Guide.

Restrictions and guidelines: PBR configuration

If the device performs forwarding in software, PBR does not process IP packets destined for the local device.

If the device performs forwarding in hardware and a packet destined for it matches a PBR policy, PBR will execute the apply clauses in the policy, including the clause for forwarding. When you configure a PBR policy, be careful to avoid this situation.

PBR tasks at a glance

To configure PBR, perform the following tasks:

1.        Configuring a policy

a.    Creating a node

b.    Setting match criteria for a node

c.    Configuring actions for a node

2.        Specifying a policy for PBR

Choose the following tasks as needed:

¡  Specifying a policy for local PBR

¡  Specifying a policy for interface PBR

Configuring a policy

Creating a node

1.        Enter system view.

system-view

2.        Create a node for a policy, and enter its view.

policy-based-route policy-name [ deny | permit ] node node-number

3.        (Optional.) Configure a description for the policy node.

description text

By default, no description is configured for a policy node.

Setting match criteria for a node

Procedure

1.        Enter system view.

system-view

2.        Enter policy node view.

policy-based-route policy-name [ deny | permit ] node node-number

3.        Set match criteria.

¡  Set an ACL match criterion.

if-match acl { acl-number | name acl-name }

By default, no ACL match criterion is set.

The ACL match criterion cannot match Layer 2 information.

When using the ACL to match packets, PBR ignores the action (permit or deny) and time range settings in the ACL.

Configuring actions for a node

About apply clauses

You can use the apply next-hop clause set next hops for matching packets on a node.

Restrictions and guidelines

If you specify a next hop or default next hop, PBR periodically performs a lookup in the FIB table to determine its availability. Temporary service interruption might occur if PBR does not update the route immediately after its availability status changes.

Configuring actions to direct packet forwarding

1.        Enter system view.

system-view

2.        Enter policy node view.

policy-based-route policy-name [ deny | permit ] node node-number

3.        Configure actions.

¡  Set next hops.

apply next-hop [ vpn-instance vpn-instance-name ] { ip-address [ direct ] [ track track-entry-number ] }&<1-2>

By default, no next hop is specified.

On a node, you can specify a maximum of two next hops for backup in one command line or by executing this command multiple times.

Specifying a policy for PBR

Specifying a policy for local PBR

About local PBR

Perform this task to specify a policy for local PBR to guide the forwarding of locally generated packets.

Restrictions and guidelines

You can specify only one policy for local PBR and must make sure the specified policy already exists. Before you apply a new policy, you must first remove the current policy.

Local PBR might affect local services such as ping and Telnet. When you use local PBR, make sure you fully understand its impact on local services of the device.

Procedure

1.        Enter system view.

system-view

2.        Specify a policy for local PBR.

ip local policy-based-route policy-name

By default, local PBR is not enabled.

Specifying a policy for interface PBR

About interface PBR

Perform this task to apply a policy to an interface to guide the forwarding of packets received on the interface.

Restrictions and guidelines

You can apply only one policy to an interface and must make sure the specified policy already exists. Before you can apply a new interface PBR policy to an interface, you must first remove the current policy from the interface.

You can apply a policy to multiple interfaces.

Procedure

1.        Enter system view.

system-view

2.        Enter interface view.

interface interface-type interface-number

3.        Specify a policy for interface PBR.

ip policy-based-route policy-name

By default, no interface policy is applied to an interface.

Display and maintenance commands for PBR

Execute display commands in any view and reset commands in user view.

 

Task

Command

Display PBR policy information.

display ip policy-based-route [ policy policy-name ]

Display interface PBR configuration and statistics.

display ip policy-based-route interface interface-type interface-number [ slot slot-number ]

Display local PBR configuration and statistics.

display ip policy-based-route local [ slot slot-number ]

Display PBR configuration.

display ip policy-based-route setup

Clear PBR statistics.

reset ip policy-based-route statistics [ policy policy-name ]

PBR configuration examples

Example: Configuring packet type-based local PBR

Network configuration

As shown in Figure 1, Switch B and Switch C do not have a route to reach each other.

Configure PBR on Switch A to forward all TCP packets to the next hop 1.1.2.2 (Switch B).

Figure 1 Network diagram

Procedure

1.        Configure Switch A:

# Create VLAN 10 and VLAN 20.

<SwitchA> system-view

[SwitchA] vlan 10

[SwitchA-vlan10] quit

[SwitchA] vlan 20

[SwitchA-vlan20] quit

# Configure the IP addresses of VLAN-interface 10 and VLAN-interface 20.

[SwitchA] interface vlan-interface 10

[SwitchA-Vlan-interface10] ip address 1.1.2.1 24

[SwitchA-Vlan-interface10] quit

[SwitchA] interface vlan-interface 20

[SwitchA-Vlan-interface20] ip address 1.1.3.1 24

[SwitchA-Vlan-interface20] quit

# Configure ACL 3101 to match TCP packets.

[SwitchA] acl advanced 3101

[SwitchA-acl-ipv4-adv-3101] rule permit tcp

[SwitchA-acl-ipv4-adv-3101] quit

# Configure Node 5 for the policy aaa to forward TCP packets to next hop 1.1.2.2.

[SwitchA] policy-based-route aaa permit node 5

[SwitchA-pbr-aaa-5] if-match acl 3101

[SwitchA-pbr-aaa-5] apply next-hop 1.1.2.2

[SwitchA-pbr-aaa-5] quit

# Configure local PBR by applying the policy aaa to Switch A.

[SwitchA] ip local policy-based-route aaa

2.        Configure Switch B:

# Create VLAN 10.

<SwitchB> system-view

[SwitchB] vlan 10

[SwitchB-vlan10] quit

# Configure the IP address of VLAN-interface 10.

[SwitchB] interface vlan-interface 10

[SwitchB-Vlan-interface10] ip address 1.1.2.2 24

3.        Configure Switch C:

# Create VLAN 20.

<SwitchC> system-view

[SwitchC] vlan 20

[SwitchC-vlan20] quit

# Configure the IP address of VLAN-interface 20.

[SwitchC] interface vlan-interface 20

[SwitchC-Vlan-interface20] ip address 1.1.3.2 24

Verifying the configuration

1.        Perform telnet operations to verify that local PBR on Switch A operates as configured to forward the matching TCP packets to the next hop 1.1.2.2 (Switch B), as follows:

# Verify that you can telnet to Switch B from Switch A successfully. (Details not shown.)

# Verify that you cannot telnet to Switch C from Switch A. (Details not shown.)

2.        Verify that Switch A forwards packets other than TCP packets through VLAN-interface 20. For example, verify that you can ping Switch C from Switch A. (Details not shown.)

Example: Configuring packet type-based interface PBR

Network configuration

As shown in Figure 2, Switch B and Switch C do not have a route to reach each other.

Configure PBR on Switch A to forward all TCP packets received on VLAN-interface 11 to the next hop 1.1.2.2 (Switch B).

Figure 2 Network diagram

Procedure

1.        Make sure Switch B and Switch C can reach Host A. (Details not shown.)

2.        Configure Switch A:

# Create VLAN 10 and VLAN 20.

<SwitchA> system-view

[SwitchA] vlan 10

[SwitchA-vlan10] quit

[SwitchA] vlan 20

[SwitchA-vlan20] quit

# Configure the IP addresses of VLAN-interface 10 and VLAN-interface 20.

[SwitchA] interface vlan-interface 10

[SwitchA-Vlan-interface10] ip address 1.1.2.1 24

[SwitchA-Vlan-interface10] quit

[SwitchA] interface vlan-interface 20

[SwitchA-Vlan-interface20] ip address 1.1.3.1 24

[SwitchA-Vlan-interface20] quit

# Configure ACL 3101 to match TCP packets.

[SwitchA] acl advanced 3101

[SwitchA-acl-ipv4-adv-3101] rule permit tcp

[SwitchA-acl-ipv4-adv-3101] quit

# Configure Node 5 for the policy aaa to forward TCP packets to next hop 1.1.2.2.

[SwitchA] policy-based-route aaa permit node 5

[SwitchA-pbr-aaa-5] if-match acl 3101

[SwitchA-pbr-aaa-5] apply next-hop 1.1.2.2

[SwitchA-pbr-aaa-5] quit

# Configure interface PBR by applying the policy aaa to VLAN-interface 11.

[SwitchA] interface vlan-interface 11

[SwitchA-Vlan-interface11] ip address 10.110.0.10 24

[SwitchA-Vlan-interface11] ip policy-based-route aaa

[SwitchA-Vlan-interface11] quit

Verifying the configuration

1.        Perform telnet operations to verify that interface PBR on Switch A operates as configured to forward the matching TCP packets to the next hop 1.1.2.2 (Switch B), as follows:

# Verify that you can telnet to Switch B from Host A successfully. (Details not shown.)

# Verify that you cannot telnet to Switch C from Host A. (Details not shown.)

2.        Verify that Switch A forwards packets other than TCP packets through VLAN-interface 20. For example, verify that you can ping Switch C from Host A. (Details not shown.)

Example: Configuring packet type-based global PBR

Network configuration

As shown in Figure 3, Switch E and Switch F do not have a route to reach each other.

Configure global PBR on Switch D to forward TCP packets to the next hop 1.1.4.2 (Switch E).

Figure 3 Network diagram

Procedure

1.        Configure IP addresses for the interfaces. Make sure Switch A, B and C can communicate with Switch E and Switch F, respectively. (Details not shown.)

2.        Configure Switch D:

# Configure ACL 3101 to match TCP packets sourced from networks 1.1.1.0/24, 1.1.2.0/24, and 1.1.3.0/24.

<SwitchD> system-view

[SwitchD] acl advanced 3101

[SwitchD-acl-ipv4-adv-3101] rule permit tcp source 1.1.1.0 0.0.0.0.255

[SwitchD-acl-ipv4-adv-3101] rule permit tcp source 1.1.2.0 0.0.0.0.255

[SwitchD-acl-ipv4-adv-3101] rule permit tcp source 1.1.3.0 0.0.0.0.255

[SwitchD-acl-ipv4-adv-3101] quit

# Configure node 5 in PBR policy aaa to forward TCP packets that match ACL 3101 to next hop 1.1.4.2.

[SwitchD] policy-based-route aaa permit node 5

[SwitchD-pbr-aaa-5] if-match acl 3101

[SwitchD-pbr-aaa-5] apply next-hop 1.1.4.2

[SwitchD-pbr-aaa-5] quit

# Specify PBR policy aaa as the global PBR policy.

[SwitchD] ip global policy-based-route aaa

Verifying the configuration

1.        Perform telnet operations to verify that global PBR on Switch D operates as configured to forward the matching TCP packets to the next hop 1.1.4.2 (Switch E), as follows:

# Verify that you can telnet to Switch E from Switch A, Switch B, and Switch C successfully. (Details not shown.)

# Verify that you cannot telnet to Switch F from Switch A, Switch B, or Switch C. (Details not shown.)

2.        Verify that Switch D forwards packets other than TCP packets as long as a route is available. For example, verify that you can ping Switch F from Switch A, Switch B, and Switch C. (Details not shown.)