Table of Contents

Related Documents

12-IPv6 policy-based routing configuration

Title	Size	Download
12-IPv6 policy-based routing configuration	182.71 KB

Configuring IPv6 PBR

About IPv6 PBR

IPv6 policy-based routing (PBR) uses user-defined policies to route IPv6 packets. A policy can specify parameters for packets that match specific criteria such as ACLs or that have specific lengths. The parameters include the next hop, output interface, SRv6 TE policy, default next hop, default output interface, and default SRv6 TE policy.

IPv6 packet forwarding process

When the device receives an IPv6 packet, the device searches the IPv6 PBR policy for a matching node to forward that packet.

· If a matching node is found and its match mode is permit, the device performs the following operations:

a. Uses the next hops, output interfaces, or SRv6 TE policies specified on the node to forward the packet, or forward the packet in SRv6 BE mode.

b. Searches the routing table for a route (except the default route) to forward the packet if one of the following conditions exists:

- No next hops, output interfaces, or SRv6 TE policies are specified on the node, or packet forwarding in SRv6 BE mode is not set.

- Forwarding failed based on the next hops, output interfaces, or SRv6 TE policies, or failed in SRv6 BE mode.

c. Uses the default next hops, default output interfaces, or default SRv6 TE policies specified on the node to forward the packet or forward the packet in default SRv6 BE mode if one of the following conditions exists:

- No matching route was found in the routing table.

- The routing table-based forwarding failed.

d. Uses the default route to forward the packet if one of the following conditions exists:

- No default next hops, default output interfaces, or default SRv6 TE policies are specified on the node, or packet forwarding in default SRv6 BE mode is not set.

- Forwarding failed based on the default next hops, default output interfaces, or default SRv6 TE policies, or failed in default SRv6 BE mode.

· The device performs routing table lookup to forward the packet in either of the following conditions:

¡ No matching node is found.

¡ A matching node is found, but its match mode is deny.

IPv6 PBR types

IPv6 PBR includes the following types:

· Local PBR—Guides the forwarding of locally generated packets, such as the ICMP packets generated by using the ping command.

· Interface PBR—Guides the forwarding of packets received on an interface only.

Policy

An IPv6 policy includes match criteria and actions to be taken on the matching packets. A policy can have one or multiple nodes as follows:

· Each node is identified by a node number. A smaller node number has a higher priority.

· A node contains if-match and apply clauses. An if-match clause specifies a match criterion, and an apply clause specifies an action.

· A node has a match mode of permit or deny.

An IPv6 policy compares packets with nodes in priority order. If a packet matches the criteria on a node, it is processed by the action on the node. If the packet does not match any criteria on the node, it goes to the next node for a match. If the packet does not match the criteria on any node, the device performs a routing table lookup for the packet.

Relationship between if-match clauses

You can specify multiple if-match clauses for a node, but only one if-match clause of each type. A packet that matches all the if-match clauses of a node matches the node.

Relationship between apply clauses

You can specify multiple apply clauses for a node, but some of them might not be executed. For more information about the relationship between the apply clauses, see "Configuring actions for an IPv6 node."

Relationship between the match mode and clauses on the node

Does a packet match all the if-match clauses on the node?	Match mode
Does a packet match all the if-match clauses on the node?	In permit mode	In deny mode
Yes	· If the node contains apply clauses, IPv6 PBR executes the apply clauses on the node. ¡ If IPv6 PBR-based forwarding succeeds, IPv6 PBR does not compare the packet with the next node. ¡ If IPv6 PBR-based forwarding fails, IPv6 PBR does not compare the packet with the next node. · If the node does not contain apply clauses, the device performs a routing table lookup for the packet.	The device performs a routing table lookup for the packet.
No	IPv6 PBR compares the packet with the next node.	IPv6 PBR compares the packet with the next node.

NOTE:

A node that has no if-match clauses matches any packet.

IPv6 PBR and Track

IPv6 PBR can work with the Track feature to dynamically adapt the availability status of an apply clause to the link status of a tracked object. The tracked object can be a next hop, output interface, default next hop, or default output interface.

· When the track entry associated with an object changes to Negative, the apply clause is invalid.

· When the track entry changes to Positive or NotReady, the apply clause is valid.

For more information about Track and IPv6 PBR collaboration, see High Availability Configuration Guide.

Restrictions and guidelines: IPv6 PBR configuration

If a packet destined for the local device matches an IPv6 PBR policy, IPv6 PBR will execute the apply clauses in the policy, including the clause for forwarding. When you configure an IPv6 PBR policy, be careful to avoid this situation.

If traffic matches both a QoS policy configured globally or on an interface by using the MQC approach and an IPv6 PBR policy configured on an interface (for example, the same ACL rule), IPv6 PBR applies. Traffic will not match the QoS policy. For more information about QoS commands, see ACL and QoS Command Reference.

IPv6 PBR tasks at a glance

To configure IPv6 PBR, perform the following tasks:

1. Configuring an IPv6 policy

a. Creating an IPv6 node

b. Setting match criteria for an IPv6 node

c. Configuring actions for an IPv6 node

2. Specifying a policy for IPv6 PBR

Choose the following tasks as needed:

¡ Specifying an IPv6 policy for IPv6 local PBR

¡ Specifying an IPv6 policy for IPv6 interface PBR

3. (Optional.) Enabling the IPv6 PBR logging feature

Configuring an IPv6 policy

Creating an IPv6 node

1. Enter system view.

system-view

2. Create an IPv6 policy or policy node and enter its view.

ipv6 policy-based-route policy-name [ deny | permit ] node node-number

Setting match criteria for an IPv6 node

1. Enter system view.

system-view

2. Enter IPv6 policy node view.

ipv6 policy-based-route policy-name [ deny | permit ] node node-number

3. Set match criteria.

¡ Set an ACL match criterion.

if-match acl { ipv6-acl-number | name ipv6-acl-name }

By default, no ACL match criterion is set.

The ACL match criterion cannot match Layer 2 information.

IPv6 PBR will use the permit or deny action and the time range setting in the specified ACL to match packets.

Configuring actions for an IPv6 node

About apply clauses

The apply clauses allow you to specify the actions to be taken on matching packets on a node.

The following apply clauses determine the packet forwarding paths in a descending order:

· apply access-vpn vpn-instance

· apply next-hop

· apply output-interface

· apply srv6-policy

· apply default-next-hop

· apply default-srv6-policy

IPv6 PBR supports the types of apply clauses shown in Table 1.

Table 1 Priorities and meanings of apply clauses

Clause	Meaning	Priority
apply precedence	Sets an IP precedence.	This clause is always executed.
apply access-vpn vpn-instance	Sets VPN instances.	If a packet matches a forwarding entry of a specified VPN instance, it is forwarded in the VPN instance.
apply next-hop, apply output-interface, apply srv6-policy, and apply srv6-be	Sets next hops, output interfaces, and SRv6 TE policies, and the SRv6 BE packet forwarding mode.	Only the apply clause with the highest priority is executed.

‌

Restrictions and guidelines for action configuration

If you specify a next hop or default next hop, IPv6 PBR periodically performs a lookup in the FIB table to determine its availability. Temporary service interruption might occur if IPv6 PBR does not update the route immediately after its availability status changes.

Setting an IP preference

1. Enter system view.

system-view

2. Enter IPv6 policy node view.

ipv6 policy-based-route policy-name [ deny | permit ] node node-number

3. Set an IP precedence.

apply precedence { type | value }

By default, no IP precedence is specified.

Configuring actions for a node

1. Enter system view.

system-view

2. Enter IPv6 policy node view.

ipv6 policy-based-route policy-name [ deny | permit ] node node-number

3. Configure actions for a node.

¡ Set VPN instances.

apply access-vpn vpn-instance vpn-instance-name

By default, no VPN instances are specified.

You can specify a maximum of n VPN instances for a node. The matching packets are forwarded according to the forwarding table of the first available VPN instance.

¡ Set next hops for permitted IPv6 packets.

apply next-hop [ vpn-instance vpn-instance-name ] { ipv6-address [ direct ] [ track track-entry-number ] }&<1-2>

By default, no next hops are specified.

You can specify a maximum of two next hops for backup or load sharing in one command line or by executing this command multiple times.

If multiple next hops on the same subnet are specified for backup, the device first uses the subnet route for the next hops to forward packets when the primary next hop fails. If the subnet route is not available, the device selects a backup next hop.

¡ Set output interfaces.

apply output-interface { interface-type interface-number [ track track-entry-number ] }

By default, no output interfaces are specified.

¡ Set SRv6 TE policies.

apply srv6-policy { endpoint color [ { sid | vpnsid } sid ] }&<1-2>

By default, no SRv6 TE policies are specified.

You can specify a maximum of two SRv6 TE policies in one command line or by executing this command multiple times. The first available SRv6 TE policy selected according to configuration order will be used to forward matching packets.

¡ Configure packet forwarding in SRv6 BE mode.

apply srv6-be remote-sid { remote-sid locator-prefix-len }&<1-2>

By default, packets are not forwarded in SRv6 BE mode.

This feature is available only for the following cards:

Card category	Cards
CEPC	CEPC-XP4LX, CEPC-XP24LX, CEPC-XP48RX, CEPC-CP4RX, CEPC-CP4RXA, CEPC-CP4RX-L, CEPC-CQ8L, CEPC-CQ8LA, CEPC-CQ8L1A, CEPC-CQ16L1
CSPEX	CSPEX-1304X, CSPEX-1404X, CSPEX-1502X, CSPEX-1504X, CSPEX-1504XA, CSPEX-1602X, CSPEX-1602XA, CSPEX-1804X, CSPEX-1512X, CSPEX-1612X, CSPEX-1812X, CSPEX-1802X, CSPEX-1802XA, CSPEX-2612XA, CSPEX-1812X-E, CSPEX-2304X-G, CSPEX-1502XA
SPE	RX-SPE200, RX-SPE200-E

The following cards support SRv6 services only in SDN-WAN system operating mode:

Card category	Cards
CEPC	CEPC-XP4LX, CEPC-XP24LX, CEPC-XP48RX, CEPC-CP4RX, CEPC-CP4RXA, CEPC-CP4RX-L
CSPEX	CSPEX-1304X, CSPEX-1404X, CSPEX-1502X, CSPEX-1504X, CSPEX-1504XA, CSPEX-1602X, CSPEX-1602XA, CSPEX-1804X, CSPEX-1512X, CSPEX-1612X, CSPEX-1812X
SPE	RX-SPE200

¡ Set default next hops.

apply default-next-hop [ vpn-instance vpn-instance-name ] { ipv6-address [ direct ] [ track track-entry-number ] }&<1-2>

By default, no default next hops are specified.

You can specify a maximum of two default next hops for backup or load sharing in one command line or by executing this command multiple times.

¡ Set default SRv6 TE policies.

apply default-srv6-policy { endpoint color [ { sid | vpnsid } sid ] }&<1-2>

By default, no default SRv6 TE policies are specified.

You can specify a maximum of two default SRv6 TE policies in one command line or by executing this command two times. The first available default SRv6 TE policy selected according to configuration order will be used to forward matching packets.

¡ Configure packet forwarding in default SRv6 BE mode.

apply default-srv6-be remote-sid { remote-sid locator-prefix-len }&<1-2>

By default, packets are not forwarded in default SRv6 BE mode.

This feature is available only for the following cards:

Card category	Cards
CEPC	CEPC-XP4LX, CEPC-XP24LX, CEPC-XP48RX, CEPC-CP4RX, CEPC-CP4RXA, CEPC-CP4RX-L, CEPC-CQ8L, CEPC-CQ8LA, CEPC-CQ8L1A, CEPC-CQ16L1
CSPEX	CSPEX-1304X, CSPEX-1404X, CSPEX-1502X, CSPEX-1504X, CSPEX-1504XA, CSPEX-1602X, CSPEX-1602XA, CSPEX-1804X, CSPEX-1512X, CSPEX-1612X, CSPEX-1812X, CSPEX-1802X, CSPEX-1802XA, CSPEX-2612XA, CSPEX-1812X-E, CSPEX-2304X-G, CSPEX-1502XA
SPE	RX-SPE200, RX-SPE200-E

The following cards support SRv6 services only in SDN-WAN system operating mode:

Card category	Cards
CEPC	CEPC-XP4LX, CEPC-XP24LX, CEPC-XP48RX, CEPC-CP4RX, CEPC-CP4RXA, CEPC-CP4RX-L
CSPEX	CSPEX-1304X, CSPEX-1404X, CSPEX-1502X, CSPEX-1504X, CSPEX-1504XA, CSPEX-1602X, CSPEX-1602XA, CSPEX-1804X, CSPEX-1512X, CSPEX-1612X, CSPEX-1812X
SPE	RX-SPE200

Specifying a policy for IPv6 PBR

Specifying an IPv6 policy for IPv6 local PBR

About this task

Perform this task to specify an IPv6 policy for IPv6 local PBR to guide the forwarding of locally generated packets.

Restrictions and guidelines

You can specify only one policy for IPv6 local PBR and must make sure the specified policy already exists. Before you apply a new policy, you must first remove the current policy.

IPv6 local PBR might affect local services, such as ping and Telnet. When you use IPv6 local PBR, make sure you fully understand its impact on local services of the device.

Procedure

1. Enter system view.

system-view

2. Specify an IPv6 policy for IPv6 local PBR.

ipv6 local policy-based-route policy-name

By default, IPv6 local PBR is not enabled.

Specifying an IPv6 policy for IPv6 interface PBR

About this task

Perform this task to apply an IPv6 policy to an interface to guide the forwarding of packets received on the interface only.

Restrictions and guidelines

You can apply only one policy to an interface and must make sure the specified policy already exists. Before you apply a new policy, you must first remove the current policy from the interface.

You can apply a policy to multiple interfaces.

In a CUPS network, this feature takes effect only for the Ethernet interface or Ethernet subinterface on a UP.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Specify an IPv6 policy for IPv6 interface PBR.

ipv6 policy-based-route policy-name [ share-mode ]

By default, no IPv6 policy is applied to the interface.

Enabling the IPv6 PBR logging feature

About this task

The IPv6 PBR logging feature helps the administrator locate and fix faults. The feature logs IPv6 PBR events and sends the logs to the information center. The information center processes the logs according to output rules. For more information about the information center, see Network Management and Monitoring Configuration Guide.

Procedure

1. Enter system view.

system-view

2. Enable the IPv6 PBR logging feature.

ipv6 policy-based-route-log enable

By default, the IPv6 PBR logging feature is disabled.

Display and maintenance commands for IPv6 PBR

Execute display commands in any view and reset commands in user view.

Task	Command
Display IPv6 PBR policy information.	display ipv6 policy-based-route [ policy policy-name ]
Display IPv6 PBR configuration.	display ipv6 policy-based-route setup
Display IPv6 local PBR configuration and statistics.	In standalone mode: display ipv6 policy-based-route local [ slot slot-number [ cpu cpu-number ] ] In IRF mode: display ipv6 policy-based-route local [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]
Display IPv6 interface PBR configuration and statistics.	In standalone mode: display ipv6 policy-based-route interface interface-type interface-number [ slot slot-number [ cpu cpu-number ] ] In IRF mode: display ipv6 policy-based-route interface interface-type interface-number [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]
Clear IPv6 PBR statistics.	reset ipv6 policy-based-route statistics [ policy policy-name ]

IPv6 PBR configuration examples

Example: Configuring packet type-based IPv6 local PBR

Network configuration

As shown in Figure 1, Router B and Router C are connected through Router A. Router B and Router C do not have a route to reach each other.

Configure IPv6 PBR on Router A to forward all TCP packets to the next hop 1::2 (Router B).

Figure 1 Network diagram

‌

Procedure

1. Configure Router A:

# Configure the IPv6 addresses of Ten-GigabitEthernet 3/1/1 and Ten-GigabitEthernet 3/1/2.

<RouterA> system-view

[RouterA] interface ten-gigabitethernet 3/1/1

[RouterA-Ten-GigabitEthernet3/1/1] ipv6 address 1::1 64

[RouterA-Ten-GigabitEthernet3/1/1] quit

[RouterA] interface ten-gigabitethernet 3/1/2

[RouterA-Ten-GigabitEthernet3/1/2] ipv6 address 2::1 64

[RouterA-Ten-GigabitEthernet3/1/2] quit

# Configure ACL 3001 to match TCP packets.

[RouterA] acl ipv6 advanced 3001

[RouterA-acl-ipv6-adv-3001] rule permit tcp

[RouterA-acl-ipv6-adv-3001] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1::2.

[RouterA] ipv6 policy-based-route aaa permit node 5

[RouterA-pbr6-aaa-5] if-match acl 3001

[RouterA-pbr6-aaa-5] apply next-hop 1::2

[RouterA-pbr6-aaa-5] quit

# Configure IPv6 local PBR by applying policy aaa to Router A.

[RouterA] ipv6 local policy-based-route aaa

2. On Router B, configure the IPv6 address of Ten-GigabitEthernet 3/1/1.

<RouterB> system-view

[RouterB] interface ten-gigabitethernet 3/1/1

[RouterB-Ten-GigabitEthernet3/1/1] ipv6 address 1::2 64

3. On Router C, configure the IPv6 address of Ten-GigabitEthernet 3/1/2.

<RouterC> system-view

[RouterC] interface ten-gigabitethernet 3/1/2

[RouterC-Ten-GigabitEthernet3/1/2] ipv6 address 2::2 64

Verifying the configuration

1. Perform telnet operations to verify that IPv6 local PBR on Router A operates as configured to forward the matching TCP packets to the next hop 1::2 (Router B), as follows:

# Verify that you can telnet to Router B from Router A successfully. (Details not shown.)

# Verify that you cannot telnet to Router C from Router A. (Details not shown.)

2. Verify that Router A forwards packets other than TCP packets through Ten-GigabitEthernet 3/1/2. For example, verify that you can ping Router C from Router A. (Details not shown.)

Example: Configuring packet type-based IPv6 interface PBR

Network configuration

As shown in Figure 2, Router B and Router C do not have a route to reach each other.

Configure IPv6 PBR on Router A to forward all TCP packets received on Ten-GigabitEthernet 3/1/1 to the next hop 1::2 (Router B).

Figure 2 Network diagram

‌

Procedure

1. Configure IPv6 addresses and unicast routing protocol settings to make sure Router B and Router C each have a route to reach Host A. (Details not shown.)

2. Configure Router A:

# Configure ACL 3001 to match TCP packets.

[RouterA] acl ipv6 advanced 3001

[RouterA-acl-ipv6-adv-3001] rule permit tcp

[RouterA-acl-ipv6-adv-3001] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1::2.

[RouterA] ipv6 policy-based-route aaa permit node 5

[RouterA-pbr6-aaa-5] if-match acl 3001

[RouterA-pbr6-aaa-5] apply next-hop 1::2

[RouterA-pbr6-aaa-5] quit

# Configure IPv6 interface PBR by applying policy aaa to Ten-GigabitEthernet 3/1/1.

[RouterA] interface ten-gigabitethernet 3/1/1

[RouterA-Ten-GigabitEthernet3/1/1] undo ipv6 nd ra halt

[RouterA-Ten-GigabitEthernet3/1/1] ipv6 policy-based-route aaa

[RouterA-Ten-GigabitEthernet3/1/1] quit

Verifying the configuration

1. Enable IPv6 and configure the IPv6 address 10::3 for Host A.

C:\>ipv6 install

Installing...

Succeeded.

C:\>ipv6 adu 4/10::3

2. Perform telnet operations to verify that IPv6 interface PBR on Router A operates as configured to forward the matching TCP packets to the next hop 1::2 (Router B), as follows:

# Verify that you can telnet to Router B from Host A successfully. (Details not shown.)

# Verify that you cannot telnet to Router C from Host A. (Details not shown.)

3. Verify that Router A forwards packets other than TCP packets through Ten-GigabitEthernet 3/1/3. For example, verify that you can ping Router C from Host A. (Details not shown.)

07-Layer 3—IP Routing Configuration Guide

Configuring IPv6 PBR

Relationship between if-match clauses

Relationship between apply clauses

Relationship between the match mode and clauses on the node

IPv6 PBR tasks at a glance

Configuring an IPv6 policy

About apply clauses

Restrictions and guidelines for action configuration

Setting an IP preference

Configuring actions for a node

About this task

Restrictions and guidelines

Procedure

About this task

Restrictions and guidelines

Procedure

About this task

Procedure

Network configuration

Procedure

Verifying the configuration

Network configuration

Procedure

Verifying the configuration

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

Company Information

News & Events

Contact Us