IPv6 policy-based routing (PBR) uses user-defined policies to route IPv6 packets. You can define PBR policies for the system to take specified actions on the packets that match the specified criteria such as an ACL. For example, you can set a next hop or default next hop for the matching packets.

IPv6 packet forwarding process

When the device receives an IPv6 packet, the device searches the IPv6 PBR policy for a matching node to forward that packet.

· If a matching node is found and its match mode is permit, the device performs the following operations:

a. Uses the next hops specified on the node to forward the packet.

b. Searches the routing table for a route (except the default route) to forward the packet if one of the following conditions exists:

- No next hops are specified on the node.

- Forwarding failed based on the next hops.

c. Uses the default next hops specified on the node to forward the packet if one of the following conditions exists:

- No matching route was found in the routing table.

- The routing table-based forwarding failed.

d. Uses the default route to forward the packet if one of the following conditions exists:

- No default next hops are specified on the node.

- Forwarding default failed based on the next hops.

· The device performs routing table lookup to forward the packet in either of the following conditions:

¡ No matching node is found.

¡ A matching node is found, but its match mode is deny.

IPv6 PBR types

IPv6 PBR includes the following types:

· Local PBR—Guides the forwarding of locally generated packets, such as the ICMP packets generated by using the ping command.

· Interface PBR—Guides the forwarding of packets received on an interface only.

Policy

An IPv6 policy includes match criteria and actions to be taken on the matching packets. A policy can have one or multiple nodes as follows:

· Each node is identified by a node number. A smaller node number has a higher priority.

· A node contains if-match and apply clauses. An if-match clause specifies a match criterion, and an apply clause specifies an action.

· A node has a match mode of permit or deny.

An IPv6 policy compares packets with nodes in priority order. If a packet matches the criteria on a node, it is processed by the action on the node. Otherwise, it goes to the next node for a match. If the packet does not match the criteria on any node, the device performs a routing table lookup for the packet.

Relationship between if-match clauses

On a node, you can specify multiple types of if-match clauses and only one if-match clause for each type.

To match a node, a packet must match all types of the if-match clauses for the node.

Relationship between apply clauses

You can specify multiple apply clauses for a node, but some of them might not be executed. For more information about the relationship between the apply clauses, see "Configuring actions for an IPv6 node."

Relationship between the match mode and clauses on the node

Does a packet match all the if-match clauses on the node?	Match mode
Does a packet match all the if-match clauses on the node?	In permit mode	In deny mode
Yes	· If the node contains apply clauses, IPv6 PBR executes the apply clauses on the node. ¡ If IPv6 PBR-based forwarding succeeds, IPv6 PBR does not compare the packet with the next node. ¡ If IPv6 PBR-based forwarding fails, IPv6 PBR does not compare the packet with the next node. · If the node does not contain apply clauses, the device performs a routing table lookup for the packet.	The device performs a routing table lookup for the packet.
No	IPv6 PBR compares the packet with the next node.	IPv6 PBR compares the packet with the next node.

‌

NOTE:

A node that has no if-match clauses matches any packet.

‌

IPv6 PBR and Track

IPv6 PBR can work with the Track feature to dynamically adapt the availability status of an apply clause to the link status of a tracked object. The tracked object can be a next hop or default next hop.

· When the track entry associated with an object changes to Negative, the apply clause is invalid.

· When the track entry changes to Positive or NotReady, the apply clause is valid.

For more information about Track-IPv6 PBR collaboration, see High Availability Configuration Guide.

Restrictions and guidelines: IPv6 PBR configuration

If a packet destined for the local device matches an IPv6 PBR policy, IPv6 PBR will execute the apply clauses in the policy, including the clause for forwarding. When you configure an IPv6 PBR policy, be careful to avoid this situation.

IPv6 PBR tasks at a glance

To configure IPv6 PBR, perform the following tasks:

1. Configuring an IPv6 policy

a. Creating an IPv6 node

b. Setting match criteria for an IPv6 node

c. Configuring actions for an IPv6 node

2. Specifying a policy for IPv6 PBR

Choose the following tasks as needed:

¡ Specifying an IPv6 policy for IPv6 local PBR

¡ Specifying an IPv6 policy for IPv6 interface PBR

¡ Specifying an IPv6 policy for IPv6 global PBR

3. (Optional.) Enabling IPv6 PBR to ignore IPv6 packets destined to the local interface

4. (Optional.) Enabling the IPv6 PBR logging feature

Configuring an IPv6 policy

Creating an IPv6 node

1. Enter system view.

system-view

2. Create an IPv6 policy or policy node and enter its view.

ipv6 policy-based-route policy-name [ deny | permit ] node node-number

3. (Optional.) Configure a description for the IPv6 policy node.

description text

By default, no description is configured for an IPv6 policy node.

Setting match criteria for an IPv6 node

1. Enter system view.

system-view

2. Enter IPv6 policy node view.

ipv6 policy-based-route policy-name [ deny | permit ] node node-number

3. Set match criteria.

¡ Set an ACL match criterion.

if-match acl { ipv6-acl-number | name ipv6-acl-name }

By default, no ACL match criterion is set.

The ACL match criterion cannot match Layer 2 information.

When using the ACL to match packets, IPv6 interface PBR ignores the action (permit or deny) in the ACL.

For packets matching the deny statement in the ACL, IPv6 local PBR does not execute the apply clause configured on the node. Instead, it compares the packets with the next node.

¡ Set a service chain match criterion.

if-match service-chain path-id service-path-id [ path-index service-path-index ]

By default, no service chain match criterion is set.

Configuring actions for an IPv6 node

About this task

The apply clauses allow you to specify actions to take on matching packets on a node.

The following apply clauses determine the packet forwarding paths in a descending order:

· apply next-hop

· apply output-interface

· apply default-next-hop

IPv6 PBR supports the apply clauses in Table 1.

Table 1 Apply clauses supported in IPv6 PBR

Clause	Meaning	Remarks
apply loadshare { default-next-hop \| next-hop }	Enables load sharing among multiple next hops or default next hops.	Multiple next hop or default next hop options operate in either primary/backup or load sharing mode. · Primary/backup mode—A next hop is selected from all next hops in configuration order for packet forwarding, with all remaining next hops as backups. When the selected next hop fails, the next available next hop takes over. · Load sharing mode—Matching traffic is distributed across the available next hops. If the traffic does not match any fast forwarding entries, per-packet load sharing is performed. If the traffic matches a fast forwarding entry, per-flow load sharing is performed. By default, the primary/backup mode applies. For the load sharing mode to take effect, make sure multiple next hops or default next hops are set in the policy.
apply access-vpn	Specifies the forwarding tables that can be used for the matching packets.	Use this clause only in special scenarios that require sending packets received from one network to another network, for example, from a VPN to the public network, or from one VPN to another VPN. The device forwards the matching packets by using the first available forwarding table selected in the order in which they are specified.
apply next-hop and apply output-interface	Sets next hops and output interfaces.	If multiple clauses are configured, only the clause with the highest priority is executed.
apply default-next-hop	Sets default next hops.	The clause takes effect only in the following cases: · No next hops are set, or the next hops are invalid. · The packet does not match any route in the IPv6 routing table.
apply service-chain	Sets service chain information.	For this clause to take effect, you must also use the apply next-hop clause to specify a reachable next hop.
apply statistics	Counts successful matches and matching bytes on the IPv6 policy node.	To include the number of successful matches and matching bytes on an IPv6 policy node in the statistics displayed by a display command, execute this command. This clause is always executed for matching packets.

‌

Restrictions and guidelines for action configuration

IPv6 PBR periodically performs a lookup in the FIB table to determine the availability of a next hop specified in an IPv6 PBR policy. If a route change occurs to the next hop, IPv6 PBR might not update the route immediately. This results in a temporary communication interruption.

Configuring actions for a node

1. Enter system view.

system-view

2. Enter IPv6 policy node view.

ipv6 policy-based-route policy-name [ deny | permit ] node node-number

3. Configure actions for a node.

¡ Set next hops for permitted IPv6 packets.

apply next-hop [ vpn-instance vpn-instance-name ] { ipv6-address [ direct ] [ track track-entry-number ] [ service-chain path-id service-path-id [ path-index service-path-index ] ] } &<1-8>

By default, no next hops are specified.

You can specify multiple next hops for backup or load sharing in one command line or by executing this command multiple times. You can specify a maximum of eight next hops for a node.

If multiple next hops on the same subnet are specified for backup, the device first uses the subnet route for the next hops to forward packets when the primary next hop fails. If the subnet route is not available, the device selects a backup next hop.

¡ Enable load sharing among multiple next hops.

apply loadshare next-hop

By default, the next hops operate in primary/backup mode.

¡ Set output interfaces.

apply output-interface NULL 0

By default, no output interfaces are specified.

¡ Set default next hops.

apply default-next-hop [ vpn-instance vpn-instance-name ] { ipv6-address [ direct ] [ track track-entry-number ] [ service-chain path-id service-path-id [ path-index service-path-index ] ] } &<1-2>

By default, no default next hops are specified.

On a node, you can specify a maximum of eight default next hops for backup or load sharing in one command line or by executing this command multiple times.

¡ Enable load sharing among multiple default next hops.

apply loadshare default-next-hop

By default, the default next hops operate in primary/backup mode.

¡ Set service chain information.

apply service-chain path-id service-path-id [ path-index service-path-index ]

By default, no service chain information is set.

Collecting statistics

1. Enter system view.

system-view

2. Enter IPv6 policy node view.

ipv6 policy-based-route policy-name [ deny | permit ] node node-number

3. Enable match counting on the IPv6 policy node.

apply statistics

By default, match counting is disabled on an IPv6 policy node.

Specifying a policy for IPv6 PBR

Specifying an IPv6 policy for IPv6 local PBR

About this task

Perform this task to specify an IPv6 policy for IPv6 local PBR to guide the forwarding of locally generated packets.

Restrictions and guidelines

You can specify only one policy for IPv6 local PBR and must make sure the specified policy already exists. Before you apply a new policy, you must first remove the current policy.

IPv6 local PBR might affect local services, such as ping and Telnet. When you use IPv6 local PBR, make sure you fully understand its impact on local services of the device.

Procedure

1. Enter system view.

system-view

2. Specify an IPv6 policy for IPv6 local PBR.

ipv6 local policy-based-route policy-name

By default, IPv6 local PBR is not enabled.

Specifying an IPv6 policy for IPv6 interface PBR

About this task

Perform this task to apply an IPv6 policy to an interface to guide the forwarding of packets received on the interface only.

To apply an IPv6 policy to multiple VLAN interfaces at the same time, you can use the ipv6 policy-based-route apply command. Using this command simplifies configuration and saves device resources.

Restrictions and guidelines

You can apply only one policy to an interface and must make sure the specified policy already exists. Before you apply a new policy, you must first remove the current policy from the interface.

You can apply a policy to multiple interfaces.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Specify an IPv6 policy for IPv6 interface PBR.

ipv6 policy-based-route policy-name

By default, no IPv6 policy is applied to the interface.

Specifying an IPv6 policy for IPv6 global PBR

About this task

Perform this task to apply an IPv6 policy to all interfaces on the device to guide the forwarding of packets received on the interfaces.

Restrictions and guidelines

You can apply only one IPv6 policy for IPv6 global PBR and the specified IPv6 policy must already exist. Before you can apply a new IPv6 policy, you must first remove the current IPv6 policy.

IPv6 interface PBR takes precedence over IPv6 global PBR on an interface. When they are both configured and packets fail to match the IPv6 interface PBR policy, IPv6 global PBR applies.

Procedure

1. Enter system view.

system-view

2. Specify an IPv6 policy for IPv6 global PBR.

ipv6 global policy-based-route policy-name

By default, no IPv6 policy is specified for IPv6 global PBR.

Enabling IPv6 PBR to ignore IPv6 packets destined to the local interface

About this task

If the device performs forwarding in hardware and a packet destined for it matches an IPv6 PBR policy, IPv6 PBR will execute the apply clauses in the policy, including the clause for forwarding. To prevent IPv6 PBR from mistakenly forwarding the packet to another device, you can perform this task. Upon receiving a packet destined to any IPv6 addresses of the interface, the device will ignore IPv6 PBR settings and deliver the packet to the CPU.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Enable IPv6 PBR to ignore IPv6 packets destined to the local interface.

ipv6 ignore policy-based-route dest-local enable

By default, IPv6 PBR does not ignore IPv6 packets destined to the local interface.

Enabling the IPv6 PBR logging feature

About this task

The IPv6 PBR logging feature helps the administrator locate and fix faults. The feature logs IPv6 PBR events and sends the logs to the information center. The information center processes the logs according to output rules. For more information about the information center, see System Management Configuration Guide.

Procedure

1. Enter system view.

system-view

2. Enable the IPv6 PBR logging feature.

ipv6 policy-based-route-log enable

By default, the IPv6 PBR logging feature is disabled.

Verifying and maintaining IPv6 PBR

Verifying IPv6 PBR policy configuration

To display IPv6 PBR policy information, execute the following command in any view:

display ipv6 policy-based-route [ policy policy-name ]

Displaying IPv6 PBR configuration and statistics

Perform display tasks in any view.

· Display IPv6 PBR configuration.

display ipv6 policy-based-route setup

· Display IPv6 local PBR configuration and statistics.

display ipv6 policy-based-route local [ slot slot-number ]

· Display IPv6 global PBR configuration and statistics.

display ipv6 policy-based-route global [ slot slot-number ]

· Display IPv6 interface PBR configuration and statistics.

display ipv6 policy-based-route interface interface-type interface-number [ slot slot-number ]

Clearing IPv6 PBR statistics

To clear IPv6 PBR statistics, execute the following command in user view:

reset ipv6 policy-based-route statistics [ policy policy-name ]

IPv6 PBR configuration examples

Example: Configuring packet type-based IPv6 local PBR

Network configuration

As shown in Figure 1, Switch B and Switch C are connected through Switch A. Switch B and Switch C do not have a route to reach each other.

Configure IPv6 PBR on Switch A to forward all TCP packets to the next hop 1::2 (Switch B).

Figure 1 Network diagram

‌

Procedure

1. Configure Switch A:

# Create VLAN 10 and VLAN 20.

<SwitchA> system-view

[SwitchA] vlan 10

[SwitchA-vlan10] quit

[SwitchA] vlan 20

[SwitchA-vlan20] quit

# Configure the IPv6 addresses of VLAN-interface 10 and VLAN-interface 20.

[SwitchA] interface vlan-interface 10

[SwitchA-Vlan-interface10] ipv6 address 1::1 64

[SwitchA-Vlan-interface10] quit

[SwitchA] interface vlan-interface 20

[SwitchA-Vlan-interface20] ipv6 address 2::1 64

[SwitchA-Vlan-interface20] quit

# Configure ACL 3001 to match TCP packets.

[SwitchA] acl ipv6 advanced 3001

[SwitchA-acl-ipv6-adv-3001] rule permit tcp

[SwitchA-acl-ipv6-adv-3001] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1::2.

[SwitchA] ipv6 policy-based-route aaa permit node 5

[SwitchA-pbr6-aaa-5] if-match acl 3001

[SwitchA-pbr6-aaa-5] apply next-hop 1::2

[SwitchA-pbr6-aaa-5] quit

# Configure IPv6 local PBR by applying policy aaa to Switch A.

[SwitchA] ipv6 local policy-based-route aaa

2. Configure Switch B:

# Create VLAN 10.

<SwitchB> system-view

[SwitchB] vlan 10

[SwitchB-vlan10] quit

# Configure the IPv6 address of VLAN-interface 10.

[SwitchB] interface vlan-interface 10

[SwitchB-Vlan-interface10] ipv6 address 1::2 64

3. Configure Switch C:

# Create VLAN 20.

<SwitchC> system-view

[SwitchC] vlan 20

[SwitchC-vlan20] quit

# Configure the IPv6 address of VLAN-interface 20.

[SwitchC] interface vlan-interface 20

[SwitchC-Vlan-interface20] ipv6 address 2::2 64

Verifying the configuration

1. Perform telnet operations to verify that IPv6 local PBR on Switch A operates as configured to forward the matching TCP packets to the next hop 1::2 (Switch B), as follows:

# Verify that you can telnet to Switch B from Switch A successfully. (Details not shown.)

# Verify that you cannot telnet to Switch C from Switch A. (Details not shown.)

2. Verify that Switch A forwards packets other than TCP packets through VLAN-interface 20. For example, verify that you can ping Switch C from Switch A. (Details not shown.)

Example: Configuring packet type-based IPv6 interface PBR

Network configuration

As shown in Figure 2, Switch B and Switch C do not have a route to reach each other.

Configure IPv6 PBR on Switch A to forward all TCP packets received on VLAN-interface 11 to the next hop 1::2 (Switch B).

Figure 2 Network diagram

‌

Procedure

1. Configure IPv6 addresses and unicast routing protocol settings to make sure Switch B and Switch C can reach Host A. (Details not shown.)

2. Configure Switch A:

# Configure ACL 3001 to match TCP packets.

[SwitchA] acl ipv6 advanced 3001

[SwitchA-acl-ipv6-adv-3001] rule permit tcp

[SwitchA-acl-ipv6-adv-3001] quit

# Configure Node 5 for policy aaa to forward TCP packets to next hop 1::2.

[SwitchA] ipv6 policy-based-route aaa permit node 5

[SwitchA-pbr6-aaa-5] if-match acl 3001

[SwitchA-pbr6-aaa-5] apply next-hop 1::2

[SwitchA-pbr6-aaa-5] quit

# Configure IPv6 interface PBR by applying policy aaa to VLAN-interface 11.

[SwitchA] interface vlan-interface 11

[SwitchA-Vlan-interface11] undo ipv6 nd ra halt

[SwitchA-Vlan-interface11] ipv6 policy-based-route aaa

Verifying the configuration

1. Enable IPv6 and configure the IPv6 address 10::3 for Host A.

C:\>ipv6 install

Installing...

Succeeded.

C:\>ipv6 adu 4/10::3

2. Perform telnet operations to verify that IPv6 interface PBR on Switch A operates as configured to forward the matching TCP packets to the next hop 1::2 (Switch B), as follows:

# Verify that you can telnet to Switch B from Host A successfully. (Details not shown.)

# Verify that you cannot telnet to Switch C from Host A. (Details not shown.)

3. Verify that Switch A forwards packets other than TCP packets through VLAN-interface 20. For example, verify that you can ping Switch C from Host A. (Details not shown.)

08-Layer 3—IP Routing Configuration Guide

Configuring IPv6 PBR

Relationship between if-match clauses

Relationship between apply clauses

Relationship between the match mode and clauses on the node

IPv6 PBR tasks at a glance

Configuring an IPv6 policy

About this task

Restrictions and guidelines for action configuration

Configuring actions for a node

Collecting statistics

About this task

Restrictions and guidelines

Procedure

About this task

Restrictions and guidelines

Procedure

About this task

Restrictions and guidelines

Procedure

About this task

Procedure

About this task

Procedure

Network configuration

Procedure

Verifying the configuration

Network configuration

Procedure

Verifying the configuration

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us