 Feedback
|
Table Of Contents
Multi-VRF Selection Using Policy Based Routing (PBR)
Prerequisites for Multi-VRF Selection Using Policy Based Routing (PBR)
Restrictions for Multi-VRF Selection Using Policy Based Routing (PBR)
Information About Multi-VRF Selection Using Policy Based Routing (PBR)
Policy Routing of VPN Traffic Based on Match Criteria
Policy Based Routing Set Clauses
How to Configure Multi-VRF Selection Using Policy Based Routing (PBR)
Defining the Match Criteria for Multi-VRF Selection Using PBR
Configuring Multi-VRF Selection Using PBR with a Standard Access List
Configuring Multi-VRF Selection Using PBR with a Named Access List
Configuring Multi-VRF Selection in a Route Map
Configuring Multi-VRF Selection Using PBR on the Interface
Configuring IP VRF Receive on the Interface
Verifying the Configuration of Multi-VRF Selection Using PBR
Configuration Examples for Multi-VRF Selection Using Policy Based Routing (PBR)
Defining the Match Criteria for Multi-VRF Selection: Example
Configuring Multi-VRF Selection in a Route Map: Examples
Verifying Multi-VRF Selection Using Policy Based Routing: Examples
Feature Information for Multi-VRF Selection Using Policy Based Routing (PBR)
Multi-VRF Selection Using Policy Based Routing (PBR)
First Published: June 5, 2007Last Updated: April 10, 2012The Multi-VRF Selection Using Policy Based Routing (PBR) feature allows a specified interface on a provider edge (PE) router to route packets to Virtual Private Networks (VPNs) based on packet length or match criteria defined in an IP access list.
You can enable VRF selection by policy-routing packets through a route map, through the global routing table, or to a specified VRF.
You can enable policy-routing packets for virtual route forwarding (VRF) instances by using route-map commands with the following set clauses:
•
set vrf—Routes packets through a specified VRF instance. The router looks for the outgoing interface in the VRF table.
•
•
•
This feature and the VRF Selection Based on Source IP Address feature can be configured together on the same interface.
Finding Feature Information in This Module
Your Cisco IOS software release may not support all of the features documented in this module. To reach links to specific feature documentation in this module and to see a list of the releases in which each feature is supported, use the "Feature Information for Multi-VRF Selection Using Policy Based Routing (PBR)" section.
Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
•
•
•
•
•
Prerequisites for Multi-VRF Selection Using Policy Based Routing (PBR)
•
Restrictions for Multi-VRF Selection Using Policy Based Routing (PBR)
•
•
•
•
•
•
Information About Multi-VRF Selection Using Policy Based Routing (PBR)
Before using the Multi-VRF Selection Using Policy Based Routing (PBR) feature, you need to understand the following concepts:
•
•
Policy Routing of VPN Traffic Based on Match Criteria
The Multi-VRF Selection Using Policy Based Routing (PBR) feature is an extension of the VRF Selection Based on Source IP Address feature. The PBR implementation of the VRF selection feature allows you to policy-route VPN traffic based on match criteria. Match criteria are defined in an IP access list or are based on packet length. The following match criteria are supported in Cisco IOS software:
•
•
Policy routing is defined in the route map. The route map is applied to the incoming interface with the ip policy route-map interface configuration command. An IP access list is applied to the route map with the match ip address route map configuration command. Packet length match criteria are applied to the route map with the match length route map configuration command. The set action is defined with the set vrf route map configuration command. The match criteria are evaluated, and the appropriate VRF is selected by the set clause. This combination allows you to define match criteria for incoming VPN traffic and policy-route VPN packets out to the appropriate VRF.
Policy Based Routing Set Clauses
When configuring PBR, the following four set clauses can be used to change normal routing and forwarding behavior:
•
•
•
•
Configuring any of the above set clauses overwrites the normal routing and forwarding behavior of a packet.
The Multi-VRF Selection Using Policy Based Routing (PBR) feature introduces the fifth set clause that can be used to change normal routing and forwarding behavior. The set vrf command is used to select the appropriate VRF after a successful match occurs in the route map.
How to Configure Multi-VRF Selection Using Policy Based Routing (PBR)
This section contains the following procedures:
•
•
•
•
•
Defining the Match Criteria for Multi-VRF Selection Using PBR
The match criteria for multi-VRF selection using PBR are defined in an access list. Standard and named access lists are supported. The following sections explain how to configure PBR route selection:
•
•
Match criteria can also be defined based on the packet length by configuring the match length route-map configuration command. This configuration option is defined entirely within a route map.
Prerequisites
The tasks in the following sections assume that the VRF and associated IP address are already defined.
Configuring Multi-VRF Selection Using PBR with a Standard Access List
This procedure uses a standard access list.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Configuring Multi-VRF Selection Using PBR with a Named Access List
This task uses a named extended access list.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Configuring Multi-VRF Selection in a Route Map
Incoming packets are filtered through the match criteria that are defined in the route map. After a successful match occurs, the set vrf command configuration determines the VRF through which the outbound VPN packets will be policy-routed.
Prerequisites
•
•
Restrictions
•
SUMMARY STEPS
1.
2.
3.
4.
or
match length minimum-length maximum-length
5.
6.
or
set ip global next-hop ip-address [ip-address]
7.
DETAILED STEPS
Configuring Multi-VRF Selection Using PBR on the Interface
The route map is attached to the incoming interface with the ip policy route-map interface configuration command.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Configuring IP VRF Receive on the Interface
The source IP address must be added to the VRF selection table. VRF Selection is a one-way (unidirectional) feature. It is applied to the incoming interface. If a match and set operation occurs in the route map but there is no receive entry in the local VRF table, the packet is dropped if the packet destination is local.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Verifying the Configuration of Multi-VRF Selection Using PBR
To verify the configuration of the Multi-VRF Selection Using Policy Based Routing (PBR) feature, perform the following steps.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Configuration Examples for Multi-VRF Selection Using Policy Based Routing (PBR)
This section contains the following configuration examples:
•
•
•
Defining the Match Criteria for Multi-VRF Selection: Example
In the following example, three standard access lists are created to define match criteria for three different subnets. Any packets received on Ethernet interface 0/1 will be policy-routed through the PBR-VRF-Selection route map to the VRF that is matched in the same route map sequence. If the source IP address of the packet is part of the 10.1.0.0/24 subnet, VRF_1 will be used for routing and forwarding.
access-list 40 permit 10.1.0.0 0.0.255.255access-list 50 permit 10.2.0.0 0.0.255.255access-list 60 permit 10.3.0.0 0.0.255.255route-map PBR-VRF-Selection permit 10match ip address 40set vrf VRF_1!route-map PBR-VRF-Selection permit 20match ip address 50set vrf VRF_2!route-map PBR-VRF-Selection permit 30match ip address 60set vrf VRF_3!interface Ethernet0/1ip address 192.168.1.6 255.255.255.252ip policy route-map PBR-VRF-Selectionip vrf receive VRF_1ip vrf receive VRF_2ip vrf receive VRF_3Configuring Multi-VRF Selection in a Route Map: Examples
The following example shows a set ip vrf command that applies policy based routing to the VRF interface named Pink and specifies that the IP address of the next hop is 192.168.3.2:
Router(config)# route-map RED permitRouter(config-route-map)# set ip vrf Pink next-hop 192.168.3.2 Router(config-route-map)# match ip address 101The following example shows a set ip global command that specifies that the router should use the next-hop address 192.168.4.2 in the global routing table:
Router(config-route-map)# set ip global next-hop 192.168.4.2Verifying Multi-VRF Selection Using Policy Based Routing: Examples
The following verification examples show defined match criteria and route-map policy configuration.
Verifying Match Criteria
To verify the configuration of match criteria for PBR Multi-VRF selection, use the show ip access-lists command. The following show ip access-lists command output displays three subnet ranges defined as match criteria in three standard access lists:
Router# show ip access-listsStandard IP access list 4010 permit 10.1.0.0, wildcard bits 0.0.255.255Standard IP access list 5010 permit 10.2.0.0, wildcard bits 0.0.255.255Standard IP access list 6010 permit 10.3.0.0, wildcard bits 0.0.255.255Verifying Route-Map Configuration
To verify route-map configuration, use the show route-map command. The output displays the match criteria and set action for each route-map sequence. The output also displays the number of packets and bytes that have been policy-routed per each route-map sequence.
Router# show route-map NHroute-map NH, permit, sequence 10Match clauses:Set clauses:ip next-hop vrf RED 5.5.5.5 6.6.6.6 7.7.7.7ip next-hop global 8.8.8.8 9.9.9.9Policy routing matches: 0 packets, 0 bytesRouter# show route-map NH2route-map NH2, permit, sequence 10Match clauses:Set clauses:vrf REDPolicy routing matches: 0 packets, 0 bytesRouter# show route-map NH3route-map NH3, permit, sequence 10Match clauses:Set clauses:globalPolicy routing matches: 0 packets, 0 bytesThe following show route-map command displays output from the set ip vrf command:
Router(config)# route-map testRouter(config-route-map)# set ip vrf Pink nRouter(config-route-map)# set ip vrf Pink next-hop 192.168.3.2Router(config-route-map)# match ip addr 255 101Router(config-route-map)# endRouter# show route-maproute-map test, permit, sequence 10Match clauses:ip address (access-lists): 101Set clauses:ip vrf Pink next-hop 192.168.3.2Policy routing matches: 0 packets, 0 bytesThe following show route-map command displays output from the set ip global command:
Router(config)# route-map testRouter(config-route-map)# match ip addr 255 101Router(config-route-map)# set ip global nRouter(config-route-map)# set ip global next-hop 192.168.4.2Router(config-route-map)# endRouter# show route-map*May 25 13:45:55.551: %SYS-5-CONFIG_I: Configured from console by consoleout-maproute-map test, permit, sequence 10Match clauses:ip address (access-lists): 101Set clauses:ip global next-hop 192.168.4.2Policy routing matches: 0 packets, 0 bytesVerifying PBR Multi-VRF Selection Policy
The following show ip policy command output displays the interface and associated route map that is configured for policy routing.
Router# show ip policyInterface Route mapEthernet0/1 PBR-VRF-SelectionAdditional References
The following sections provide references related to the Multi-VRF Selection Using Policy Based Routing (PBR) feature.
Related Documents
Selection of the source IP address instead of the policy based routing approach used in this document
IP access list commands
Cisco IOS IP Addressing Services Command Reference, Release 12.2SR
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
RFCs
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
—
Technical Assistance
Command Reference
This section documents only commands that are new or modified.
set ip global
To indicate where to forward packets that pass a match clause of a route map for policy routing and for which the Cisco IOS software uses the global routing table, use the set ip global command in route-map configuration mode. To disable this feature, use the no form of this command.
set ip global next-hop ip-address [...ip-address]
no set ip global next-hop ip-address [...ip-address]
Syntax Description
Command Default
The router uses the next-hop address in the global routing table.
Command Modes
Route-map configuration
Command History
Usage Guidelines
Use this command to allow packets to enter a VRF interface and be policy-routed or forwarded out of the global table.
An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the ip-address argument.
Examples
The following example allows use of the global table and specifies that the next-hop address is 10.5.5.5:
set ip global next-hop 10.5.5.5Related Commands
set ip vrf
To indicate where to forward packets that pass a match clause of a route map for policy routing when the next hop must be under a specified virtual route forwarding (VRF) name, use the set ip vrf command in route-map configuration mode. To disable this feature, use the no form of this command.
set ip vrf vrf-name next-hop {ip-address [... ip-address] | recursive ip-address}
no set ip vrf vrf-name next-hop {ip-address [... ip-address] | recursive ip-address}
Syntax Description
Command Default
The next hop does not have to be under a specified VRF.
Command Modes
Route-map configuration
Command History
Usage Guidelines
The set ip vrf command allows you to apply policy based routing to a VRF interface.
An ellipsis (...) in the command syntax indicates that your command input can include multiple values for the ip-address argument.
Use the ip policy route-map interface configuration command, the route-map global configuration command, and match configuration commands to define the conditions for policy-routing packets. The ip policy route-map command identifies a route map by name. Each route-map command has a list of match and set commands associated with it. The match commands specify the match criteria—the conditions under which policy routing occurs. The set commands specify the set actions—the particular routing actions to perform if the criteria enforced by the match commands are met.
If the interface associated with the first next hop specified with the set ip vrf command is down, the optionally specified IP addresses are tried in turn.
The set clauses can be used in conjunction with one another. They are evaluated in the following order:
1.
2.
3.
4.
5.
6.
7.
Examples
The following example specifies that the next hop must be under the VRF name that has the IP address 10.5.5.5:
set ip vrf myvrf next-hop 10.5.5.5Related Commands
show route-map
To display static and dynamic route maps, use the show route-map command in privileged EXEC mode.
show route-map [map-name | dynamic [dynamic-map-name | application [application-name]] | all] [detailed]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
For Cisco IOS Release 12.3(14)T and later 12.4 and 12.4T releases, you can display the ACL-specific information that pertains to the route map in the same display without having to execute a show route-map command to display each ACL that is associated with the route map.
Examples
The show route-map command will display configured route-maps, match, set, and continue clauses. The output will vary depending on which keywords are included with the command, and which software image is running in your router.
show route-map Command with No Keywords Specified Example
The following is sample output from the show route-map command:
Router# show route-maproute-map ROUTE-MAP-NAME, permit, sequence 10Match clauses:ip address (access-lists): 1metric 10Continue: sequence 40Set clauses:as-path prepend 10Policy routing matches: 0 packets, 0 bytesroute-map ROUTE-MAP-NAME, permit, sequence 20Match clauses:ip address (access-lists): 2metric 20Set clauses:as-path prepend 10 10Policy routing matches: 0 packets, 0 bytesroute-map ROUTE-MAP-NAME, permit, sequence 30Match clauses:Continue: to next entry 40Set clauses:as-path prepend 10 10 10Policy routing matches: 0 packets, 0 bytesroute-map ROUTE-MAP-NAME, deny, sequence 40Match clauses:community (community-list filter): 20:2Set clauses:local-preference 100Policy routing matches: 0 packets, 0 bytesroute-map LOCAL-POLICY-MAP, permit, sequence 10Match clauses:Set clauses:community 655370Policy routing matches: 0 packets, 0 bytesThe following example shows Multiprotocol Label Switching (MPLS)-related route map information:
Router# show route-maproute-map OUT, permit, sequence 10Match clauses:ip address (access-lists): 1Set clauses:mpls labelPolicy routing matches: 0 packets, 0 bytesroute-map IN, permit, sequence 10Match clauses:ip address (access-lists): 2mpls labelSet clauses:Policy routing matches: 0 packets, 0 bytesTable 1 describes the significant fields shown in the display.
show route-map Command with Dynamic Route Map Specified Example
The following is sample output from the show route-map command when entered with the dynamic keyword:
Router# show route-map dynamicroute-map AAA-02/06/04-14:01:26.619-1-AppSpec, permit, sequence 0, identifier 1137954548Match clauses:ip address (access-lists): PBR#1 PBR#2Set clauses:Policy routing matches: 0 packets, 0 bytesroute-map AAA-02/06/04-14:01:26.619-1-AppSpec, permit, sequence 1, identifier 1137956424Match clauses:ip address (access-lists): PBR#3 PBR#4Set clauses:Policy routing matches: 0 packets, 0 bytesroute-map AAA-02/06/04-14:01:26.619-1-AppSpec, permit, sequence 2, identifier 1124436704Match clauses:ip address (access-lists): PBR#5 PBR#6length 10 100Set clauses:ip next-hop 172.16.1.1ip gateway 172.16.1.1Policy routing matches: 0 packets, 0 bytesCurrent active dynamic routemaps = 1The following is sample output from the show route-map command when entered with the dynamic and application keywords:
Router# show route-map dynamic applicationApplication - AAANumber of active routemaps = 1When you specify an application name, only dynamic routes for that application are shown. The following is sample output from the show route-map command when entered with the dynamic and application keywords and the AAA application name:
Router# show route-map dynamic application AAAAAANumber of active rmaps = 2AAA-02/06/04-14:01:26.619-1-AppSpecAAA-02/06/04-14:34:09.735-2-AppSpecRouter# show route-map dynamic AAA-02/06/04-14:34:09.735-2-AppSpecroute-map AAA-02/06/04-14:34:09.735-2-AppSpec, permit, sequence 0, identifier 1128046100Match clauses:ip address (access-lists): PBR#7 PBR#8Set clauses:Policy routing matches: 0 packets, 0 bytesroute-map AAA-02/06/04-14:34:09.735-2-AppSpec, permit, sequence 1, identifier 1141277624Match clauses:ip address (access-lists): PBR#9 PBR#10Set clauses:Policy routing matches: 0 packets, 0 bytesroute-map AAA-02/06/04-14:34:09.735-2-AppSpec, permit, sequence 2, identifier 1141279420Match clauses:ip address (access-lists): PBR#11 PBR#12length 10 100Set clauses:ip next-hop 172.16.1.12ip gateway 172.16.1.12Policy routing matches: 0 packets, 0 bytesCurrent active dynamic routemaps = 2show route-map Command with Detailed ACL Information for Route Maps Specified Example
The following is sample output from the show route-map command with the dynamic and detailed keywords entered:
Router# show route-map dynamic detailedroute-map AAA-01/20/04-22:03:10.799-1-AppSpec, permit, sequence 1, identifier 29675368Match clauses:ip address (access-lists):Extended IP access list PBR#31 permit icmp 0.0.16.12 1.204.167.240 10.1.1.0 0.0.0.255 syn dscp af12 log-input fragmentsExtended IP access list PBR#41 permit icmp 0.0.16.12 1.204.167.240 10.1.1.0 0.0.0.255 syn dscp af12 log-input fragmentsSet clauses:ip next-hop 172.16.1.14ip gateway 172.16.1.14Policy routing matches: 0 packets, 0 bytesshow route-map Command with Global Routing Table Information
The following is sample output from the show route-map command when the set ip global command has been specified:
route-map testmatch ip addr 255 101set ip global nset ip global next-hop 192.168.4.2endRouter# show route-map*May 25 13:45:55.551: %SYS-5-CONFIG_I: Configured from console by consoleout-maproute-map test, permit, sequence 10Match clauses:ip address (access-lists): 101Set clauses:ip global next-hop 192.168.4.2Policy routing matches: 0 packets, 0 bytesRelated Commands
Feature Information for Multi-VRF Selection Using Policy Based Routing (PBR)
Table 2 lists the release history for this feature.
Not all features may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.
Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/cfn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Note
Glossary
CE router—customer edge router. A router that is part of a customer network and that interfaces to a provider edge (PE) router.
IP—Internet Protocol. Network layer protocol in the TCP/IP stack offering a connectionless internetwork service. IP provides features for addressing, type-of-service specification, fragmentation and reassembly, and security. Defined in RFC 791.
PBR—policy based routing. PBR allows a user to manually configure how received packets should be routed.
PE router— provider edge router. A router that is part of a service provider's network and that is connected to a CE router. It exchanges routing information with CE devices by using static routing or a routing protocol such as BGP, RIPv1, or RIPv2.
VPN—Virtual Private Network. A VPN is a collection of sites sharing a common routing table. A VPN provides a secure way for customers to share bandwidth over an ISP backbone network.
VRF—a VPN routing/forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table.
VRF-lite—VRF-lite is a feature that enables a service provider to support two or more VPNs, where IP addresses can be overlapped among the VPNs.
CCVP, the Cisco logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0705R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007 Cisco Systems, Inc. All rights reserved.