XpressLearn Home

1 Star2 Stars3 Stars4 Stars5 Stars (1 votes, average: 5.00 out of 5)
Loading ... Loading ...
Policy Based Routing

There are scenarios where it would be desirable for a host or group of hosts to take a different route through the network than what is considered the normal path.  Consider this as creating a detour of sorts, forcing an alternate route to the destination.  This can be accomplished on a selective basis, by picking out certain hosts to apply the detour to without changing the course of other hosts on the same network.

The solution in this scenario is to use something called policy based routing:

Policy-based routing provides a tool for forwarding and routing data packets based on policies defined by network administrators. In effect, it is a way to have the policy override routing protocol decisions. Policy-based routing includes a mechanism for selectively applying policies based on access list, packet size or other criteria. The actions taken can include routing  packets on user-defined routes, setting the precedence, type of service bits, etc.

Consider the following diagram:

Diagram used to illustrate Policy Based Routing

Host 1 and 2 both have a default gateway of the defaultRouter, which has the address of 192.168.1.1.  The default route/next hop address in defaultRouter for all traffic is 192.168.2.1, which is named LanRouter.  When Host1 pings Host3 the full path looks like:

Host1 –> defaultRouter –> LanRouter –> Host3

Host1#traceroute 192.168.3.100

Type escape sequence to abort.
Tracing the route to 192.168.3.100

  1 192.168.1.1 152 msec 168 msec 144 msec
  2 192.168.2.1 288 msec 256 msec 172 msec
  3 192.168.3.100 264 msec 260 msec 255 msec
Host1#

Let’s say we want Host1 to take an alternate path in the network, but leave Host2 alone and allow it to continue through the original route.  A policy route will be configured on defaultRouter to look for the source address of Host1 and re-route that traffic over altLanRouter.  Any traffic sourced from Host2 will remain going through the original path via LanRouter.

First thing to configure is the access list that will be used to match the desired source address.

defaultRouter(config)#ip access-list extended hosts-to-redirect
defaultRouter(config-ext-nacl)#permit ip ?
A.B.C.D  Source address
any      Any source host
host     A single source host

defaultRouter(config-ext-nacl)#permit ip 192.168.1.100 ?
A.B.C.D  Source wildcard bits

defaultRouter(config-ext-nacl)#permit ip 192.168.1.100 0.0.0.0 ?
A.B.C.D  Destination address
any      Any destination host
host     A single destination host

defaultRouter(config-ext-nacl)#permit ip 192.168.1.100 0.0.0.0 any

Next, create the route map and configure what to use for matching traffic, which is the access list that was previously created.  Also, configure what action to take on the traffic that is matched.

defaultRouter(config-route-map)#match ip address ?
  <1-199>      IP access-list number
  <1300-2699>  IP access-list number (expanded range)
  WORD         IP access-list name
  prefix-list  Match entries of prefix-lists

defaultRouter(config-route-map)#match ip address hosts-to-redirect
defaultRouter(config-route-map)#set ?
  as-path           Prepend string for a BGP AS-path attribute
  automatic-tag     Automatically compute TAG value
  clns              OSI summary address
  comm-list         set BGP community list (for deletion)
  community         BGP community attribute
  dampening         Set BGP route flap dampening parameters
  default           Set default information
  extcommunity      BGP extended community attribute
  interface         Output interface
  ip                IP specific information
  ipv6              IPv6 specific information
  level             Where to import route
  local-preference  BGP local preference path attribute
  metric            Metric value for destination routing protocol
  metric-type       Type of metric for destination routing protocol
  mpls-label        Set MPLS label for prefix
  nlri              BGP NLRI type
  origin            BGP origin code
  tag               Tag value for destination routing protocol
  traffic-index     BGP traffic classification number for accounting
  vrf               Define VRF name
  weight            BGP weight for routing table
defaultRouter(config-route-map)#set ip ?
  address     Specify IP address
  default     Set default information
  df          Set DF bit
  next-hop    Next hop address
  precedence  Set precedence field
  qos-group   Set QOS Group ID
  tos         Set type of service field
defaultRouter(config-route-map)#set ip next-hop 192.168.2.2

Once the route map is configured the only thing left is to apply it to the interface where the traffic comes into the router, which is FastEthernet1/0.

defaultRouter(config)#int fa1/0
defaultRouter(config-if)#ip policy ?
  route-map  Policy route map

defaultRouter(config-if)#ip policy route-map ?
  WORD  Route map name

defaultRouter(config-if)#ip policy route-map altRouterRedirect

Now let’s take a look at the path Host1 takes to connect to Host3:

Host1#traceroute 192.168.3.100

Type escape sequence to abort.
Tracing the route to 192.168.3.100

  1 192.168.1.1 112 msec 168 msec 72 msec
  2 192.168.2.2 192 msec 312 msec 336 msec
  3 192.168.3.100 288 msec 288 msec 288 msec
Host1#

Now, verify that host 2 still takes the original path via LanRouter:

Host2#traceroute 192.168.3.100

Type escape sequence to abort.
Tracing the route to 192.168.3.100

  1 192.168.1.1 140 msec 144 msec 144 msec
  2 192.168.2.1 192 msec 212 msec 172 msec
  3 192.168.3.100 432 msec 384 msec 360 msec
Host2#

This configuration has successfully changed the path in the network of Host 1 and left the traffic sourced from Host 2 untouched. Keep in mind that the reply traffic from R3 is going back across defaultRouter in both scenarios, this is because Host3 has a default gateway of 192.168.3.1, which is assigned to defaultRouter. If we wanted the reply traffic from Host 3 destined to host 1 sent via altLanRouter, a policy map would need to be applied to match the destination ip address of Host 1.

Author Info:

 
 
Scott's profession is a Senior Network Engineer at a Healthcare related company in Nashville, TN. When he is not trying to secure a network or come up with a design for a new project, he enjoys spending time with his family. You can find out more at: http://www.scottp.net

Similar Posts:

 

One Response to “Policy Based Routing”

  1. Paul Smith Says:

    Hi Scott, checking back in on you after years of missing the ScottP podcast . I was wondering if you ever do any remote network consulting/architecture? I run the infrastructure for ITT Technical Institute, and I recall that when you were in hospitality, if I recall, you got a lot of experience with “commodity” wireless (for the rooms; we have a similar situation with students. Moreover, there is a corporate WAN over which some information must migrate (e.g. AD/Domain-Controllers); my guys aren’t quite up to the design of “bifurcating” the biz and student WANs (with existing WiFi on the Student side). Please feel free to drop a note back. ‘Love to chat!

Leave a Reply