Contents

Configuring PBR·· 1

About PBR· 1

Packet forwarding process· 1

PBR types· 1

Polic nodes· 2

PBR and Track· 3

Restrictions and guidelines: PBR configuration· 3

PBR tasks at a glance· 3

Configuring a policy· 3

Creating a node· 3

Setting match criteria for a node· 3

Configuring actions for a node· 4

Specifying a policy for PBR· 7

Specifying a policy for local PBR· 7

Specifying a policy for interface PBR· 7

Enabling SNMP notifications for PBR· 8

Display and maintenance commands for PBR· 8

Configuring PBR

About PBR

Policy-based routing (PBR) uses user-defined policies to route packets. A policy can specify parameters for packets that match specific criteria such as ACLs. The parameters include the next hop, output interface, default next hop, and default output interface.

PBR and routing policies have the following differences:

·     PBR applies to data packets. PBR takes the specified actions for matching packets based on user demands. The packets will not be forwarded according to routing table lookup. If PBR-based packet forwarding fails, the packets can still be forwarded according to routing table lookup.

·     Routing policies apply to routing information. Routing policies typically implement route filtering and route attribute settings. You can use routing policies to change route attributes (including reachability), in order to change the forwarding paths of network traffic.

Packet forwarding process

When the device receives a packet, the device searches the PBR policy for a matching node to forward that packet.

·     If a matching node is found and its match mode is permit, the device performs the following operations:

a.     ‍Uses the next hops or output interfaces specified on the node to forward the packet.

b.     Searches the routing table for a route (except the default route) to forward the packet if one of the following conditions exists:

-     No next hops or output interfaces are specified on the node.

-     Forwarding failed based on the next hops or output interfaces.

c.     Uses the default next hops or default output interfaces specified on the node to forward the packet if one of the following conditions exists:

-     No matching route was found in the routing table.

-     The routing table-based forwarding failed.

d.     Uses the default route to forward the packet if one of the following conditions exists:

-     No default next hops or default output interfaces are specified on the node.

-     The forwarding failed based on the default next hops or default output interfaces.

·     The device perfoms routing table lookup to forward the packet in either of the following conditions:

¡     No matching node is found.

¡     A matching node is found, but its match mode is deny.

PBR types

PBR includes the following types:

·     Local PBR—Guides the forwarding of locally generated packets, such as ICMP packets generated by using the ping command.

·     Interface PBR—Guides the forwarding of packets received on an interface.

Polic nodes

A policy includes match criteria and actions to be taken on the matching packets. A policy can have one or multiple nodes as follows:

·     Each node is identified by a node number. A smaller node number has a higher priority.

·     A node contains if-match and apply clauses. An if-match clause specifies a match criterion, and an apply clause specifies an action.

·     A node has a match mode of permit or deny.

A policy compares packets with nodes in priority order.

·     If a packet matches the criteria on a node, it is processed by the action on the node.

·     If the packet does not match any criteria on the node, it goes to the next node for a match.

·     If the packet does not match the criteria on any node, the device performs a routing table lookup.

Relationship between if-match clauses

In the current software version, the device supports specifying the if-match acl clause to set an ACL match criterion. You can specify only one if-match acl clause on a node.

Relationship between apply clauses

You can specify multiple apply clauses for a node, but some of them might not be executed. For more information about relationship between apply clauses, see "Configuring actions for a node."

Relationship between the match mode and clauses on the node

‌

‌

PBR and Track

PBR can work with the Track feature to dynamically adapt the availability status of an apply clause to the link status of a tracked object. The tracked object can be a next hop, output interface, default next hop, or default output interface.

·     When the track entry associated with an object changes to Negative, the apply clause is invalid.

·     When the track entry changes to Positive or NotReady, the apply clause is valid.

For more information about Track-PBR collaboration, see Track in High Availability Configuration Guide.

Restrictions and guidelines: PBR configuration

If the device performs forwarding in software, PBR does not process IP packets destined for the local device.

If the device performs forwarding in hardware and a packet destined for it matches a PBR policy, PBR will execute the apply clauses in the policy, including the clause for forwarding. When you configure a PBR policy, be careful to avoid this situation.

PBR tasks at a glance

To configure PBR, perform the following tasks:

1.     Configuring a policy

e.     Creating a node

f.     Setting match criteria for a node

g.     Configuring actions for a node

2.     Specifying a policy for PBR

Choose the following tasks as needed:

¡     Specifying a policy for local PBR

¡     Specifying a policy for interface PBR

3.     (Optional.) Enabling SNMP notifications for PBR

Configuring a policy

Creating a node

1.     Enter system view.

system-view

2.     Create a node for a policy, and enter its view.

policy-based-route policy-name [ deny | permit ] node node-number

Setting match criteria for a node

1.     ‍Enter system view.

system-view

2.     Enter policy node view.

policy-based-route policy-name [ deny | permit ] node node-number

3.     Set match criteria.

¡     Set an ACL match criterion.

if-match acl { acl-number | name acl-name }

By default, no ACL match criterion is set.

The ACL match criterion cannot match Layer 2 information.

 

Configuring actions for a node

About this task

The apply clauses allow you to specify the actions to be taken on matching packets on a node.

The following apply clauses determine the packet forwarding paths in a descending order:

·     apply next-hop

·     apply output-interface

·     apply default-next-hop

·     apply default-output-interface

PBR supports the apply clauses in Table 1.

Table 1 Apply clauses supported in PBR

‌

 

Restrictions and guidelines

For outbound PBR, you can specify only one next hop and the next hop must be directly connected.

If you specify a next hop or default next hop, PBR periodically performs a lookup in the FIB table to determine its availability. Temporary service interruption might occur if PBR does not update the route immediately after its availability status changes.

Configuring actions to modify packet fields

1.     Enter system view.

system-view

2.     Enter policy node view.

policy-based-route policy-name [ deny | permit ] node node-number

3.     Configure actions.

¡     Set an IP precedence.

apply precedence { type | value }

By default, no IP precedence is specified.

¡     Set the DF bit in the IP header.

apply ip-df df-value

By default, the DF bit in the IP header is not set.

Configuring actions to direct packet forwarding

1.     ‍Enter system view.

system-view

2.     Enter policy node view.

policy-based-route policy-name [ deny | permit ] node node-number

3.     Configure actions.

¡     Set next hops.

apply next-hop  { ip-address [ direct ] [ track track-entry-number ] }&<1-4>

By default, no next hops are specified.

On a node, you can specify a maximum of 16 next hops for backup or load sharing in one command line or by executing this command multiple times.

If multiple next hops on the same subnet are specified for backup, the device first uses the subnet route for the next hops to forward packets when the primary next hop fails. If the subnet route is not available, the device selects a backup next hop.

¡     Enable load sharing among multiple next hops.

apply loadshare next-hop

By default, the next hops operate in primary/backup mode.

¡     Set output interfaces.

apply output-interface { interface-type interface-number [ track track-entry-number ] }&<1-4>

By default, no output interfaces are specified.

On a node, you can specify a maximum of 16 output interfaces for backup or load sharing in one command line or by executing this command multiple times.

¡     Enable load sharing among multiple output interfaces.

apply loadshare output-interface

By default, the output interfaces operate in primary/backup mode.

¡     Set default next hops.

apply default-next-hop { ip-address [ direct ] [ track track-entry-number ] }&<1-4>

By default, no default next hops are specified.

On a node, you can specify a maximum of 16 default next hops for backup or load sharing in one command line or by executing this command multiple times.

¡     Enable load sharing among multiple default next hops.

apply loadshare default-next-hop

By default, the default next hops operate in primary/backup mode.

¡     Set default output interfaces.

apply default-output-interface { interface-type interface-number [ track track-entry-number ] }&<1-4>

By default, no default output interfaces are specified.

On a node, you can specify a maximum of 16 default output interfaces for backup or load sharing in one command line or by executing this command multiple times.

¡     Enable load sharing among multiple default output interfaces.

apply loadshare default-output-interface

By default, the default output interfaces operate in primary/backup mode.

 

Comparing packets with the next node upon match failure on the current node

1.     Enter system view.

system-view

2.     Enter policy node view.

policy-based-route policy-name [ deny | permit ] node node-number

3.     Compare packets with the next node upon match failure on the current node.

apply continue

By default, PBR does not compare packets with the next node upon match failure on the current node.

This command takes effect only when the match mode of the node is permit.

Specifying a policy for PBR

Specifying a policy for local PBR

About this task

Perform this task to specify a policy for local PBR to guide the forwarding of locally generated packets.

Restrictions and guidelines

You can specify only one policy for local PBR and must make sure the specified policy already exists. Before you apply a new policy, you must first remove the current policy.

Local PBR might affect local services such as ping and Telnet. When you use local PBR, make sure you fully understand its impact on local services of the device.

Procedure

1.     Enter system view.

system-view

2.     Specify a policy for local PBR.

ip local policy-based-route policy-name

By default, local PBR is not enabled.

Specifying a policy for interface PBR

About this task

Perform this task to apply a policy to an interface to guide the forwarding of packets received on the interface.

Restrictions and guidelines

You can apply only one policy to an interface and must make sure the specified policy already exists. Before you can apply a new interface PBR policy to an interface, you must first remove the current policy from the interface.

You can apply a policy to multiple interfaces.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Specify a policy for interface PBR.

ip policy-based-route policy-name

By default, no policy is applied to an interface.

Enabling SNMP notifications for PBR

About this task

Perform this task to enable SNMP notifications for PBR. PBR can generate notifications and send them to the SNMP module when the next hop becomes invalid. For the PBR notifications to be sent correctly, you must also configure SNMP on the device. For more information about configuring SNMP, see the network management and monitoring configuration guide for the device.

Procedure

1.     Enter system view.

system-view

2.     Enable SNMP notifications for PBR.

snmp-agent trap enable policy-based-route

By default, SNMP notifications are enabled for PBR.

Display and maintenance commands for PBR

Execute display commands in any view and reset commands in user view.

 

‌