Policy Based Routing

What it is

Policy based routing (PBR) chooses the next hop by a rule you write, instead of by the destination address alone.

A normal router looks at the destination of a packet and uses the routing table. PBR lets you add other tests first, such as the source address, the protocol or the packet size. Traffic that matches the rule goes where you say, and everything else is routed as usual.

How it works

PBR uses a route map, and the route map is applied to an interface.

The three parts

1. An access list, or another match, identifies the traffic.
2. A route map matches it and sets the action.
3. The route map is applied to an interface with ip policy route-map.

R1(config)# ip access-list extended WEB-TRAFFIC
R1(config-ext-nacl)# permit tcp 10.1.1.0 0.0.0.255 any eq 80
R1(config)# route-map PBR permit 10
R1(config-route-map)# match ip address WEB-TRAFFIC
R1(config-route-map)# set ip next-hop 192.0.2.2
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip policy route-map PBR

Here, web traffic from 10.1.1.0/24 that enters GigabitEthernet0/0 is sent to 192.0.2.2. Other traffic is not matched by the route map, so the normal routing table handles it.

Where it applies

The policy is checked on packets that enter the interface. It does not affect packets leaving.

Traffic that the router generates itself, such as pings or routing updates, does not pass through an interface policy. To policy route that traffic you use a different command, ip local policy route-map NAME, which is global.

Match and set options

A route map has permit and deny sequences, tested in order. With a permit sequence, matching packets get the set action. With a deny sequence, matching packets are sent back to the normal routing process.

Packets that match nothing in the route map are also routed normally.

The sequence numbers work as in any route map. The lowest number is tried first, and the first match wins.

Next hop and failure

A next hop set with set ip next-hop must be on a directly connected network. If that next hop is down, packets may be dropped or may be routed normally, depending on the platform and configuration. To avoid a black hole, you can tie the action to a tracked object.

R1(config-route-map)# set ip next-hop verify-availability 192.0.2.2 10 track 1

Here track 1 is an object that watches whether the next hop is reachable, for example through an IP SLA probe. If the object goes down, the router stops using that next hop. IP SLA is covered in the Network Assurance chapter.

Verifying

R1# show ip policy
R1# show route-map PBR
R1# show access-lists WEB-TRAFFIC
R1# debug ip policy

show ip policy lists the interfaces that have a policy and the route map used. show route-map shows each sequence, its match and set clauses, and the count of packets that matched.

A rising count shows that the policy is working. The debug command shows decisions for each packet, so use it with care on a busy router.

Typical uses

• Send traffic from one source network out through a second ISP.
• Send selected applications over a lower cost link.
• Steer traffic through a firewall or inspection device.
• Mark packets for QoS based on rules that a normal route cannot express.

Limits

PBR works hop by hop. Each router that you want to follow the policy needs its own configuration.

It can add load on the router, so check the platform support. It can make troubleshooting harder, because the path no longer follows the routing table alone.