There are scenarios where it would be desirable for a host or group of hosts to take a different route through the network than what is considered the normal path. Consider this as creating a detour of sorts, forcing an alternate route to the destination. This can be accomplished on a selective basis, by picking out certain hosts to apply the detour to without changing the course of other hosts on the same network.
The solution in this scenario is to use something called policy based routing:
Policy-based routing provides a tool for forwarding and routing data packets based on policies defined by network administrators. In effect, it is a way to have the policy override routing protocol decisions. Policy-based routing includes a mechanism for selectively applying policies based on access list, packet size or other criteria. The actions taken can include routing packets on user-defined routes, setting the precedence, type of service bits, etc.
Consider the following diagram:
Host 1 and 2 both have a default gatway of the defaultRouter, which has the address of 192.168.1.1. The default route/next hop address in defaultRouter for all traffic is 192.168.2.1, which is named LanRouter. When Host1 pings Host3 the full path looks like:
Host1 –> defaultRouter –> LanRouter –> Host3
Host1#traceroute 192.168.3.100 Type escape sequence to abort. Tracing the route to 192.168.3.100 1 192.168.1.1 152 msec 168 msec 144 msec 2 192.168.2.1 288 msec 256 msec 172 msec 3 192.168.3.100 264 msec 260 msec 255 msec Host1#
Let’s say we want Host1 to take an alternate path in the network, but leave Host2 alone and allow it to continue through the original route. A policy route will be configured on defaultRouter to look for the source address of Host1 and re-route that traffic over altLanRouter. Any traffic sourced from Host2 will remain going through the original path via LanRouter.
First thing to configure is the access list that will be used to match the desired source address.
defaultRouter(config)#ip access-list extended hosts-to-redirect defaultRouter(config-ext-nacl)#permit ip ? A.B.C.D Source address any Any source host host A single source host defaultRouter(config-ext-nacl)#permit ip 192.168.1.100 ? A.B.C.D Source wildcard bits defaultRouter(config-ext-nacl)#permit ip 192.168.1.100 0.0.0.0 ? A.B.C.D Destination address any Any destination host host A single destination host defaultRouter(config-ext-nacl)#permit ip 192.168.1.100 0.0.0.0 any
Next, create the route map and configure what to use for matching traffic, which is the access list that was previously created. Also, configure what action to take on the traffic that is matched.
defaultRouter(config-route-map)#match ip address ? <1-199> IP access-list number <1300-2699> IP access-list number (expanded range) WORD IP access-list name prefix-list Match entries of prefix-lists defaultRouter(config-route-map)#match ip address hosts-to-redirect defaultRouter(config-route-map)#set ? as-path Prepend string for a BGP AS-path attribute automatic-tag Automatically compute TAG value clns OSI summary address comm-list set BGP community list (for deletion) community BGP community attribute dampening Set BGP route flap dampening parameters default Set default information extcommunity BGP extended community attribute interface Output interface ip IP specific information ipv6 IPv6 specific information level Where to import route local-preference BGP local preference path attribute metric Metric value for destination routing protocol metric-type Type of metric for destination routing protocol mpls-label Set MPLS label for prefix nlri BGP NLRI type origin BGP origin code tag Tag value for destination routing protocol traffic-index BGP traffic classification number for accounting vrf Define VRF name weight BGP weight for routing table defaultRouter(config-route-map)#set ip ? address Specify IP address default Set default information df Set DF bit next-hop Next hop address precedence Set precedence field qos-group Set QOS Group ID tos Set type of service field defaultRouter(config-route-map)#set ip next-hop 192.168.2.2
Once the route map is configured the only thing left is to apply it to the interface where the traffic comes into the router, which is FastEthernet1/0.
defaultRouter(config)#int fa1/0 defaultRouter(config-if)#ip policy ? route-map Policy route map defaultRouter(config-if)#ip policy route-map ? WORD Route map name defaultRouter(config-if)#ip policy route-map altRouterRedirect
Now let’s take a look at the path Host1 takes to connect to Host3:
Host1#traceroute 192.168.3.100 Type escape sequence to abort. Tracing the route to 192.168.3.100 1 192.168.1.1 112 msec 168 msec 72 msec 2 192.168.2.2 192 msec 312 msec 336 msec 3 192.168.3.100 288 msec 288 msec 288 msec Host1#
Now, verify that host 2 still takes the original path via LanRouter:
Host2#traceroute 192.168.3.100 Type escape sequence to abort. Tracing the route to 192.168.3.100 1 192.168.1.1 140 msec 144 msec 144 msec 2 192.168.2.1 192 msec 212 msec 172 msec 3 192.168.3.100 432 msec 384 msec 360 msec Host2#
This configuration has successfully changed the path in the network of Host 1 and left the traffic sourced from Host 2 untouched. Keep in mind that the reply traffic from R3 is going back across defaultRouter in both scenarios, this is because Host3 has a default gateway of 192.168.3.1, which is assigned to defaultRouter. If we wanted the reply traffic from Host 3 destined to host 1 sent via altLanRouter, a policy map would need to be applied to match the destination ip address of Host 1.
- None Found


Print This Post
July 15th, 2008 at 9:21 pm
Hi Scott, checking back in on you after years of missing the ScottP podcast . I was wondering if you ever do any remote network consulting/architecture? I run the infrastructure for ITT Technical Institute, and I recall that when you were in hospitality, if I recall, you got a lot of experience with “commodity” wireless (for the rooms; we have a similar situation with students. Moreover, there is a corporate WAN over which some information must migrate (e.g. AD/Domain-Controllers); my guys aren’t quite up to the design of “bifurcating” the biz and student WANs (with existing WiFi on the Student side). Please feel free to drop a note back. ‘Love to chat!