Layer 3 Technologies · Topic 2 of 8
Route Maps and Policy Based Routing
Learn how route maps match and change routes, where they attach in routing protocols, and how policy based routing sends traffic by policy on IOS XE.
- 5 min
- Includes a diagram
- Route map clauses are processed by sequence number, and the first match decides.
- Every route map ends with an implicit deny.
- A clause with no
matchmatches everything.
What it is
A route map is an ordered set of match and set rules that filters or changes routes, or traffic when used for policy based routing.
Route maps appear in many places, such as redistribution, BGP neighbour policy and routing table filtering. The same logic applies everywhere, so learning it once pays off often.
Policy based routing (PBR) uses a route map on an interface to choose a next hop by policy, instead of by the destination address alone.
How it works
A route map is read from the lowest sequence number up, and the first matching clause decides.
Clause structure
Each clause has a name, an action and a sequence number. The action is permit or deny.
R1(config)# route-map SET-ATTR permit 10
R1(config-route-map)# match ip address prefix-list CUSTOMERS
R1(config-route-map)# set metric 50
R1(config-route-map)# set tag 100
R1(config)# route-map SET-ATTR permit 20A permit clause with matching routes applies its set actions. A deny clause rejects matching routes. A clause with no match line matches everything.
The end of every route map has an implicit deny. Routes that match no clause are dropped, so a final empty permit clause is often needed to let everything else through.
Match and set options
| Type | Examples |
|---|---|
| match | ip address, ip address prefix-list, tag, metric, interface, route-type |
| set (general) | metric, metric-type, tag, ip next-hop |
| set (BGP) | local-preference, weight, as-path prepend, community |
Several values on one match line are an OR. Separate match lines of different types are an AND.
Where route maps attach
The attachment point depends on the protocol and the task.
R1(config-router)# redistribute ospf 1 route-map SET-ATTR
R1(config-router)# neighbor 192.0.2.2 route-map SET-ATTR in
R1(config-router)# distribute-list route-map SET-ATTR inThe first line sets attributes while redistributing. The second applies policy to BGP routes from one neighbour. The third filters routes into the routing table in protocols that support it, such as OSPF.
A distribute list with a route map filters what enters the routing table. It does not stop OSPF link state advertisements from flooding.
Troubleshooting route maps
Check three things in order.
- Is the route map attached?
- Do the match objects, such as an ACL or prefix list, actually match the routes?
- Does an earlier clause catch the route first?
R1# show route-map SET-ATTR
R1# show ip prefix-list CUSTOMERS
R1# show ip access-listsshow route-map shows each clause and a policy routing matches counter. The counters show whether packets or routes are really hitting a clause.
Policy based routing
PBR is applied on the interface where traffic arrives. The route map matches traffic with an ACL and sets the next hop.
R1(config)# access-list 101 permit ip 10.1.1.0 0.0.0.255 any
R1(config)# route-map PBR-VOICE permit 10
R1(config-route-map)# match ip address 101
R1(config-route-map)# set ip next-hop 192.0.2.2
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip policy route-map PBR-VOICETraffic that matches is sent to the set next hop. Traffic that does not match any clause follows the normal routing table.
Traffic the router itself creates is not covered by ip policy. It needs the global command ip local policy route-map.
PBR can also use set ip next-hop verify-availability together with IP SLA tracking, so traffic falls back when the next hop fails.
R1# show ip policy
R1# show route-map PBR-VOICE
R1# debug ip policyUse debug ip policy with care on a busy router. Limit it with an ACL or a lab.
What to remember for the exam
Seven facts cover most questions on this topic.
- Route map clauses are processed by sequence number, and the first match decides.
- Every route map ends with an implicit deny.
- A clause with no
matchmatches everything. - Values on one
matchline are OR. Differentmatchlines are AND. ip policy route-mapis applied inbound on an interface.- Locally generated traffic needs
ip local policy route-map. - Unmatched traffic follows normal routing.
Reordering or inserting clauses by sequence number changes the result. Leave gaps such as 10, 20, 30 so you can add clauses later.
Common mistakes
These five mistakes appear often.
Forgetting the final permit. Routes that match no clause are dropped by the implicit deny.
Applying PBR on the outbound interface. ip policy works on traffic as it enters the interface.
Wrong match object. A prefix list or ACL that matches nothing makes the clause silently skip.
Mixing up AND and OR. Two match lines must both be true, while two values on one line need only one.
Expecting PBR to affect router traffic. Router originated packets ignore ip policy and need the local policy command.
Check yourself
Work through these three questions.
What happens to a route that matches no clause of a route map?
It is dropped, because every route map ends with an implicit deny.
On which interface and in which direction do you apply
ip policy route-map?On the interface where the traffic arrives, so it is applied to inbound traffic.
How do you make PBR apply to traffic the router itself generates?
Use the global command
ip local policy route-mapwith the route map name.
Topic 2 of 8 in Layer 3 Technologies
Test yourself on Layer 3 Technologies
The full Cisco CCNP 300-410 ENARSI question bank has 857 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.