In this video and hands-on lab, I'd
like you to click on the link for the virtual lab
if you're logged on to CBT Nuggets from a computer
and follow along step-by-step as we do this together.
Starting off, let's take a look at our topology,
and they we'll implement PBR on Router 4.
So here's our game plan.
We want to go ahead and configure R4
that, instead of going northbound for traffic
as it's forwarding down to this network,
we want to go ahead and have it forward
this way if the protocol of the traffic is ICMP-based, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this way if the protocol of the traffic is ICMP-based,
and if it's coming from the 192.168.1 network.
So we can set conditions for the PBR.
So this would be a great opportunity
to take a look at the pieces and parts
and also put it in action in the hands-on lab.
And let me drag out the syntax that we're
going to use for this, and let me go ahead
and put it right there.
So in configuring PBR, policy-based routing,
we first of all need to identify the if statement, or the match
statement.
And to do that, it's a one-two punch. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And to do that, it's a one-two punch.
We're going to use an access control list that
identifies the traffic.
Now, this ACL is not being used for filtering.
We're not going to apply it as a filtering ACL.
We're simply going to use it as a matching mechanism as part
of the route map.
And that is the one-two punch.
So we create next list here.
We're going to call it ACL-1.
And it is matching, permitting, 192.168.1, anything,
a resource going to 10.1.7 anything as a destination
if the protocol is protocol number one, ICMP-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if the protocol is protocol number one, ICMP--
great.
Then, once that ACL is created, we
can use that as part of our match conditions inside
of a route map.
And that's this part right here.
So route map, we'll call it PBR-1.
Permit 10.
Now, if you don't say the word "permit," it's assumed
"permit."
Also, if you don't put a sequence number,
it'll auto-sequence it for you.
We'll have more discussions in this course about route maps
and how they're used.
But in this case, we're going to use a route map for simply
for the purpose of policy-based routing.
And so in this road map, we have a match statement that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so in this road map, we have a match statement that
says, match IP address ACL 1.
Which basically says, if traffic matches the conditions
in this ACL, that is two thumbs up.
That's a yes.
That's the if statement.
Also, in this match statement, if it's on one line,
if we have match IP address ACL1, space, ACL2, space, ACL3,
if those are all on one line for the match, it's considered or.
Meaning, if it matches ACL1, or ACL2,
or ACL3 on that same line, it's considered an or operation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or ACL3 on that same line, it's considered an or operation.
In the sequence, if we had one line that says
match IP address ACL1, and then a second line
said match IP address ACL2, that would then be an and.
All of those conditions would have
to match if they're on separate lines.
We'll talk more about route maps in a separate set of videos.
All right, so if traffic matches ACL1, which is ICMP traffic
from this network to that network,
then the action item is set the IP next hop
to 10.34.0.3, which is R3's IP address that R4 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to 10.34.0.3, which is R3's IP address that R4
is directly connected with on that 10.34 network.
So that's-- wait a sec.
That doesn't look like the right address.
Hold the phone, Joan.
I'm going to check that, because I definitely want
to point to the right next hop.
Let's go verify what the right next hop is.
So on R4, this should be 10.0.34.
And I'm going to check my router and verify
that's the case in the lab.
So let's double-check our work before we put that in.
So here on R4, if we do a show cdp neighbor, I'll say detail, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here on R4, if we do a show cdp neighbor, I'll say detail,
it says it knows about R2-- that's to the north of it--
and it knows about R3.
And yeah, it's 10.0.39.3.
We want to put it in the right next hop.
So from our force perspective, we want to say,
if traffic matches that ACL, use the next hop of 10.0.34.3.
Otherwise, he'd be forwarding it or trying
to forward it to some IP address that doesn't even exist.
That wouldn't be good.
All right, I will update that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, I will update that.
That's going to be 0.34.3.
Great.
And so now, in policy-based routing,
once we apply this, if traffic doesn't match this-- let's
imagine traffic is coming in on the interface
we're about to apply this policy to.
Traffic is coming in on Serial3/1,
but it doesn't match that ACL, which
is in this route map, which is being applied
as policy-based routing.
The router says, cool, it doesn't match.
I'll just route this normally.
That's what it means.
So we're not going to drop traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we're not going to drop traffic.
It's just won't be specially treated
if the traffic doesn't match this.
All right, and then the way we implement this--
and we'll do this all here coming up in the lab--
is what we're going to do is we are
going to go to interface Serial3/1, and specify
IP policy route map PBR-1.
And that's how we implement PBR, or routed traffic,
on the router.
So we look back at our topology here.
This is going to implant it on Serial3/1.
So let's go to the live interface,
and let's implement this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and let's implement this.
Let's go back up to R4 here.
And here on R4, let's do a couple of things real quick.
Do a show axis list to make sure we're not
going to write on top of anything, and show IP policy.
We currently don't have any policy-based routing in place
yet.
Great, let's go and implement this.
So let's create our access controls
first to identify the traffic, and we'll
do IP access list extended.
And we'll call this ACL1.
Then we'll a permit of ICMP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then we'll a permit of ICMP.
And we're looking for traffic source from 192.168.1.anything.
Great, and destined to 10.1.7.anything.
And what I like to do is just verify,
once I put in my access list control entries,
just to do show access list, just to make sure that what we
think we put in, we did put in.
Great, so there's our ACL that we're
going to use inside the route map
that we're going to use as part of our policy-based routing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we're going to use as part of our policy-based routing.
Next, let's create the route map.
So route map, we're going to call this PBR-1,
and then we'll say Permit.
If you don't say Permit. it will automatically assume or permit.
If you don't sequence it, it will automatically
put a sequence number in as well.
I'm going to call the sequence number 10.
And then we'll specify our if, then statement.
So the If part in a route map is called Match.
And we'll do a question mark.
Now, there are a lot of options in a route map.
And we have options for a lot of BGP attributes, and metrics, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we have options for a lot of BGP attributes, and metrics,
and administrative distance, and all kinds of things.
But for policy-based routing, we're
going to be looking at matching on an access list.
So we type in IP, space, and let's just say address.
And then we finally get to put in the access list
that we made earlier--
which, if we scroll up just a little bit, we call this ACL1.
So I'm going to copy and paste it so I don't have a typo.
And then, if we were going to have
additional ACLs on this one line,
then we could have five or six ACLs.
And then, any one of those, if they matched the traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then, any one of those, if they matched the traffic
that we're looking at, it would go ahead
and be considered a yes regarding that sequence number.
So for now, in this route map, we're
only looking for the details for that one access control list.
We'll press Enter.
And now we specify what happens if traffic matches that ACL.
And we specify the policy of what will
happen with the command set.
So there's lots of options here we've set.
A lot of these refer to routing protocols,
including BGP, about manipulating attributes
that we can set.
But for us, we want to modify the next hop. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But for us, we want to modify the next hop.
So we'll specify IP, space, question mark.
And then we'll specify next hop.
And we're going to specify the next hop is going to be
the R3 address at 10.0.34.3.
I'm glad we checked that out earlier.
Then we're going to do a show route
map, just to make sure that we have
in there what we think we have.
So this says we're matching on access list one.
And if we match on axis list one,
we are then going to go ahead and set
the next hop to 10.0.34, just for those packets. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the next hop to 10.0.34, just for those packets.
Now, the third step here is to apply this to an interface.
So in our topology, we want to-- for PBR, for routed traffic,
we want to apply it to the ingress interface
where we're expecting the traffic to show up on.
So in our case, it would be interface Serial3/1
where we want to apply this policy map for PBR.
That's where the inbound traffic would
be coming that matches that access control list.
So we'll go back to R4.
And here in R4, we'll go to interface Serial3/1.
And we'll specify the command ip policy, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll specify the command ip policy,
which is how we implement the policy, question
mark, the keyword "route map," question mark,
and then the name of our route map, which is right here.
So I'm going to copy that, and right-click,
and paste it, and question mark, and we're done.
So now, if we do a show IP policy and press Enter,
it shows us that on Serial3/1, we
have a route map called PBR-1.
We do a show route map.
It can show us the details of that route map,
including what it's matching on for the access control list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
including what it's matching on for the access control list.
And then we do show access list to verify
what that match is all about in the access list itself.
So now, as far as testing this, we
need to send some ICMP traffic.
Source from 192.168.1, going to 10.1.7,
with the last octet not mattering.
So let's do a debug of ip policy.
So now, when traffic comes in on Serial3/1,
if it matches that access control list, which
is part of the route map, which part of the policy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is part of the route map, which part of the policy
that we just applied to that interface, if it matches it,
we'll say, hey, great, this matched policy-based routing.
And it'll show you that in this debug.
Or, if it didn't match, it'll say, hey,
this packet didn't match.
And as a result, I'm just going to forward it normally
based on my routing table.
So let's go ahead and test this.
All we're looking for is ICMP traffic.
So here's what we can do.
On R8, if we do a ping to 10.1.7;7--
that's the IP address on gig0/0 here,
and the 192.168.1 network is gig0/0 on R8. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the 192.168.1 network is gig0/0 on R8.
So if we do a ping and source it from R8,
we should have some policy-based routing, which
should cause R4, when it gets it,
to say, oh, that matches, and forward it over here
instead of its normal path of going to R2, R1, and so forth.
All right, let's give it a shot.
So we'll go back to our console, and let's go to router 8,
let's do a ping of 7.7.7.7.
So that shouldn't match, because it's not
sourcing from the right source IP address. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's not to the destination address matching.
But if we go back to R4, check it out--
rejected!
Meaning it just didn't match.
It just didn't match, so it was forwarded normally.
If we went back to R8 and did a trace to 10.1.7.7,
that's the IP address of R7 on that gig0/0 interface.
And we look at the path--
6, 4, 2, 1.
That didn't match either, because our a couple of things WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That didn't match either, because our a couple of things
are wrong here.
Our source address is wrong.
We're sourcing it.
We're not telling the router to source the trace
from its gig0/0 address.
So it's not matching for that reason.
But if we go back to R4, the debug
said, yep, no match, no match, no match, and just forwarding
traffic as they normally would.
So let's go to R8, and let's do a ping of 10.1.7.7,
and let's source that ping from gig0/0.
We could also put in the IP address for that interface,
but gig0/0 is the 192.168.1 network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but gig0/0 is the 192.168.1 network.
And the pings worked.
And if we go to R4, it says, hey, policy match.
And so it did policy-based routing right there,
saying the next stop.
So it said, hey, traffic is matching, [INAUDIBLE]
on this interface.
I'm going to go ahead and forward it based on the policy.
And that way, it forwarded across from R4 to R3.
Now, I've got one other little challenge here,
And that is this, and I'd like to see
if you can help me solve it.
If we go back to R8 and we do a trace to 10.1.7.7, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we go back to R8 and we do a trace to 10.1.7.7,
and we source it from our gig0/0 interface, which
is on the 192.168, and we do that, this implies
that 6, to 4, to 2, to 1, this is not
being policy-based routed, because it's
going from R2 to R1 based on the tracepath here.
If we go to R4, he's all about, no, normal forwarding.
So based on what we looked at in this video WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So based on what we looked at in this video
and how we configured policy-based routing,
what is the problem?
I mean, how do we get all the traffic, that traceroute,
to also be policy-based rooted at R4?
So that's the challenge.
I'm going to keep this lab open, and it's
the challenge we're going to take
a look at in the next video as take a look at tweaking
and troubleshooting policy-based routing in a Cisco environment.
So I'll see you in that next video and lab in just a moment.
Also, if you are running this lab,
keep this lab open so you don't have to reconfigure everything
from scratch. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
from scratch.
And then we'll continue on in the next video
in troubleshooting why the traceroute is still not using
the path from R4 over to R3.
So I'll see you in the next video in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.