So for one scenario, as an example of using policy-based routing,
let's go ahead and set up policy-based routing and let's use R7 as our target.
And as far as what we want to accomplish, let's go ahead on R7 and specify that
any traffic
sourced from PC7. So PC7's address right here is 10.1.7.10.
A traffic source from that specific IP address is destined to
go ahead and use PC8's address. So PC8 is over here. It's at 192.168.1.10. Let WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go ahead and use PC8's address. So PC8 is over here. It's at 192.168.1.10. Let
's
specify that any traffic source from PC7 and going to PC number 8 instead of
using the normal
routing table, which would normally go this way based on what we looked at in
the overview.
Instead of doing that, we'll go ahead and set the next top over here to R8's 10
.78.0.8 address
on its serial 3/2. And before we talk about the configuration and begin the
configuration,
let's also verify in the lab environment that the path without policy-based
routing
to go from PC7 over here to PC8 is indeed going from R7 to R5 to R3 to R1 to 2 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to go from PC7 over here to PC8 is indeed going from R7 to R5 to R3 to R1 to 2
to 4 and 6 and 8.
So here in the lab environment, we had the trace that we did earlier. Let's go
ahead and do that
trace again. So the dash P capital P space 1 says please use ICMP. If we didn't
do that,
we could go ahead and simply leave off the protocol we want to use and we'd use
UDP by default
at layer 4 for the trace. So we'll do a trace to 1.821cstate1.10 and indeed the
first top is
R7 and then the next top is .5R5 and then R31246 and 8. Fantastic. Any WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
R7 and then the next top is .5R5 and then R31246 and 8. Fantastic. Any
ingredients for
setting up policy-based routing are going to be an access control list so let's
go ahead and create
access control list identifying the traffic from PC7 to PC8. And for that, let
's use access
control list 107 because we need to specify the destination address as well.
And the standard ACL
will only let us point to the source IP address information. Then we'll need a
route map.
And in that route map, effectively we're going to say if traffic matches this
access control list,
then we're going to set the next top to 10.78.0.8. We also want to verify that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
then we're going to set the next top to 10.78.0.8. We also want to verify that
that interface
exists on both sides that we can ping directly across just to make sure we have
that connectivity.
So 10.78.0.8 is the IP address right there. And then to make this work, we'd
apply that policy
to interface gig 0.0. And it's going to apply to any inbound traffic. So any in
bound traffic
will be compared against the route map that's matching on the access control
list. And if there's
a match, you'll set the next top to 10.78.0.8. All right, so with that in mind, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a match, you'll set the next top to 10.78.0.8. All right, so with that in mind,
let's go ahead and
let's configure and test policy-based routing right here on router 7. And here
we go. So initially,
our path is going all the way around the network from PC7 to R7 to R5, R3, etc.
All the way down through
our 6 down to R8 as shown right here. So let's go to the right router. We'll go
to R7. I mean,
before we start creating an access control list to match on the traffic that's
going to be used
for our policy-based routing, we also should make sure we're not overriding an
existing access
control list. Let's just show access lists in press center and sure enough no WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
control list. Let's just show access lists in press center and sure enough no
access control list,
we're going to configure your mode. And let's make one. Let's create access
lists 107. And we'll do
a permit. And let's go ahead and permit the question is what protocols we want
to permit. For this
example, we're just focusing on IP addresses. So let's say permit IP, which
includes any layer
for protocols in the world of IP. And then for the source address, let's go
ahead and use the
host of PC7. And that host address is 10.1.7.10. So we'll put in 10.1.7.10 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
host of PC7. And that host address is 10.1.7.10. So we'll put in 10.1.7.10
space. And for the destination
we want to host and let's look at PC8's address real quick. It's address is 122
.1.10. And we'll put that
in 192.168.1.10. Fantastic press center. And now we have our access control
list. So let's do show
access lists. And there it is. Next, let's create a route map and include that
access control list
as one of the conditions for that route map. So to create a route map, please
the command route map
space, question mark. And then let's go ahead and call this pbr-from-PC7-2-PC8 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
space, question mark. And then let's go ahead and call this pbr-from-PC7-2-PC8
in press center. And when
I apply this to the interface gig 0 0 on our 7-hulls copy paste that. So I don
't have a typo there.
And as part of this route map, we're then going to go ahead and do a match. So
let's say match
IP address. As far as the address we're matching on, it's going to be access
list 107. So I'll go ahead and
copy and paste that. And then furthermore, if traffic does match IP address 107
, meaning source WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
, meaning source
from 10.1.7.10, going to 192.168.1.10, then we want to go and set the IP next
hop. And let's take
a look at our topology real quick. We want the next hop to be 10780.8. And that
's the IP address on
our 8's serial 3-2. So set IP next hop to 10.78.0.8. And let's type in exit and
let's take a look at our work.
Let's do a do show route map. And it is matching on access list 107. Fantastic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's do a do show route map. And it is matching on access list 107. Fantastic.
It can evit seize that.
If there's match, it's going to set the next hop to 10.78.0.8. Also while we're
here, this is
verifying we can ping that with a do ping to 10.78.0.8. And sure enough, let's
also do a trace over to 10.78.0.8.
Just to make sure it's a direct connection. And it is. So our next step is to
go ahead and apply that
policy to gig 00. So any inbound traffic coming in on gig 00 here on our 7. We
'll be considered
against the policy. And if there's a match, it'll set the next hop to our 8's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
against the policy. And if there's a match, it'll set the next hop to our 8's
address. And as a
result, it should forward the traffic directly over to our 8 over at the serial
link instead of
forwarding it up to our 5 based on the normal routing table. So we're going to
interface gig 00
here on our 7. And we'll use the syntax IP policy route map space. And then we
're going to go ahead
and copy and paste that route map name, which is right here because it's super
long. We don't
want to have a typo. So I'm going to copy it from here. And I'm going to right
click to paste it
in and a space. And that's it. Now there's not an option of in or out because
this only applies
to ingress or inbound traffic here on gig 00. So press enter and then we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to ingress or inbound traffic here on gig 00. So press enter and then we'll
type in end. And let's do
a few verification checks. Let's do a show access list. Just to make sure our
access list is correct.
1017 10 going to 192 168 1.10. Those are the addresses of PC 7 and PC 8
respectively. Fantastic.
Next to a show route map, just to verify our route map. So we're matching on
access
to 107. And if that happens, we then I guess at the next top to 1078 0.8. Then
we can do a show IP
policy and press center. It will confirm for us the route map that we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
policy and press center. It will confirm for us the route map that we have
associated for our policy
based routing and which interface it's applied to, which in this case is gig 00
. We also do a show run
for interface gig 00. There'd be another way of verifying this there. And there
it is right there.
So now we go to PC 7. And we look at that trace we did to 192 168 1.10. Now
that we have done that
policy on our 7. If we hit the upper key into the same exact trace again,
notice now it's not saying
it up to our 5 and then our 3 and our 1 etc. In this case, it's going directly WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it up to our 5 and then our 3 and our 1 etc. In this case, it's going directly
from the router or 7.
It's at .7. And the next top is 107 8 0.8. And we have this destination port un
reachable message.
And I'm going to hit the upper key and do a dash capital P. And let's do a one
for ICMP instead of UDP.
And that way the final destination won't complain that it doesn't have some UDP
open port
listing and waiting. But the path is indeed the same. Now another really cool
thing that we can do
is we can go back to our 7. And we can actually do a debug to verify that what WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is we can go back to our 7. And we can actually do a debug to verify that what
we think is happening
is indeed happening. And we can do that with a debug IP policy just like that
press enter. So any
traffic that matches the route map and is policy based routed will be indicated
by having a match
here in the debug. And a traffic that doesn't match that flow of traffic is
going to go ahead and
simply be routed as normal. So let's do examples of both. Let's go back to PC 7
. And on PC 7,
let's do a quick ping over to 192.1cg8.1.10. So this traffic should match WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's do a quick ping over to 192.1cg8.1.10. So this traffic should match
because it's coming from PC 7's
dress going to PC 8's dress. And we have the pings are working no problem. But
if you go back to our 7,
it's going to show us the debug. Check this out. Here showing us the source 10
1710, the destination
192.1cg81.10. And it shows that there was a policy match. And as a result, it
was policy based routed.
Now if we go back to PC 7 and let's ping something else in the network, let's
go back to our topology.
Let's ping. How about the loop back on R8, which is, in fact, let's do a loop WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's ping. How about the loop back on R8, which is, in fact, let's do a loop
back on R6, which is 6666.
So if we do a ping there, that traffic because it's coming from PC 7 but not
destined to the IP dress
to PC 8, that should not match our policy based routing. So from PC 7, if we do
a ping to 6.6.6.6,
that traffic because it doesn't match the PBR or the policy based routing, it
should be routed
normally. And we can also verify that with a trace up to that address 6666,
press center. And that
path is going through the R7 router, then R5, then R3, then 1, 2, 4, and 6. We WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
path is going through the R7 router, then R5, then R3, then 1, 2, 4, and 6. We
can also attach capital P
space 1 to use ICMP instead. And we'll notice that we have the same path. We
thought the error about
the destination port for UDP being unreachable at the end. And as here says,
fib policy rejected no
match is something doing normal forwarding based on the IPV for routing table,
which we can see with
show IP route. So if we go back to PC 7 to a trace to 1.0.1.6.8.1.10, it's
going to take the policy based
routed path. In fact, this is to a trace there instead, just to verify that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
routed path. In fact, this is to a trace there instead, just to verify that
little trace to that
destination. That's PC 8's address. We'll do a dash capital P protocol 1. And
that's taking the
direct path due to the policy based routing. And if we do a trace to some of
the address, for example,
let's go to 100, which is another server. In fact, let me show you that real
quick. That is server 1.0.8.
Sitting on that same subnet because it is not the destination of .10. It's not
going to be policy
based routed. It should take the long way around, which indeed it is from R7 to
R5, R3, R1, R2,
or 4, or 6, and R8. Now in preparation for the next video, I'm going to go back WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or 4, or 6, and R8. Now in preparation for the next video, I'm going to go back
to R7,
and in R7 we'll do an undibug all. Let's do a show run for interface gig 00.
And I'm going to take off
that policy. So we're going to configure ACEM mode. We'll go to interface gig
00. Let's copy paste
that to make it faster. And we'll say no. And then we'll go to IP policy route
map to take it off
and apply that. So now if we go back to PC 7, a moment ago, when we were at
trace to .10,
it was going through the policy based routed path. But now that we removed that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it was going through the policy based routed path. But now that we removed that
from the interface
on R7, if we press enter now, we're taking the normal path based on the normal
routing table.
And in the next video, you and I get to take a look at implementing policy
based routing,
but this time leveraging the layer for protocol that's in use as well. So I'll
see you in the next
video in just a moment.