In this video, I'd like to walk through an example of using policy-based
routing, but this time,
including a specific layer for protocol. So because we're using an access
control list,
we want to be using an extended ACL that can match on things such as layer for
protocols
in addition to source and/or destination. And then include that once again in a
route map.
And then apply that route map as a policy on a given interface. So the a
traffic going into
the interface is going to consider the ACL. See if there's a match. And if so,
take the action
specified in the route map. So we'll put a polite interface as the last step WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
specified in the route map. So we'll put a polite interface as the last step
there. Now as far as
what we want to do in this demonstration with layer for protocols, let's do the
following. Let's
match on TCP traffic. And focus on just the TCP. Let's go ahead and say from
anywhere to anywhere.
So effectively, if there's TCP at layer four, it's going to go ahead and be a
match in the ACL.
So let's create ACL 103 that matches on that. Let's also apply this one to
router 3. And let's
apply this traffic inbound right here on F a 4/1. So if any traffic coming in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
apply this traffic inbound right here on F a 4/1. So if any traffic coming in
on interface F a 4/1,
instead of forwarding normally based on the routing table, which would be going
up to R1,
that'd be the next hop in the path based on this routing table for IP packets.
Instead of that,
let's go ahead and have PBR use the next top of R4 at 10.0.34.4. So let me go a
little note there
next top for TCP based traffic will be our fours address on its F a 4/1
interface, which is 10.0.34.4.
And then everything else would be normally routed. So I propose that to test WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then everything else would be normally routed. So I propose that to test
this before we implement
the policy based routing here, let's go down to PC7. Let's just verify that PC7
traffic, which goes
to the default gateway here R7 and goes this way and this way. Let's verify
that that traffic is
TCP by default is being routed up through R1, then to R2 and then down this way
. And for the target,
let's go ahead and use the target of this address 6.6.6.6, which is the loop
back address here on R6.
So as a confirmation of the current path before we implement the policy based
routing here on R3, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
routing here on R3,
let's once again just verify with a trace using TCP the path that's currently
being taken.
So if we go to PC7 and let's go ahead and do a ping to 6.6.6.6, it's to verify
connectivity,
fantastic, and then we'll do a trace. And then let's do a trace to 6.6.6.6. And
I also want to do a
dash p space 6. And what that's going to do is going to use protocol number 6,
aka TCP. So let's go
ahead and verify that first. So there's our path through the network from PC7 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ahead and verify that first. So there's our path through the network from PC7
to R7 and then based
on that last octet to R5, then to R3, then to R1, R2, then to R4 and then the
loop back on R6.
And then R6 response. If we did it again, we used a different protocol like for
example,
protocol 1, which is ICMP, we're going to have the same path. So R7, R5, R3, R1
, R2, R4,
and finding hits, R6. So in the future, once we have a policy based routing set
up on R3,
we should be skipping R1 and R2. It should be setting the traffic directly over WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we should be skipping R1 and R2. It should be setting the traffic directly over
to R4.
So we should be able to verify that by these two sets of traces, one with TCP
and one with
ICMP so we can see the differences. So let's head over to R3 and R3. Let's go
ahead and verify if we
have access lists yet. So we'll do a show, access lists and let's do a show
route map and no access list,
no route maps. Great. Let's go ahead and begin. So let's create an access
control list. So let's create
access list. Let's use one and zero three. I'll say permit TCP from anywhere to
anywhere. Fantastic.
So next, let's create a route map that's looking to match based on that access WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So next, let's create a route map that's looking to match based on that access
control list. So we'll
type in route map space and let's call this pbr-tcp because that's effectively
what's going to be doing.
And then we'll say permit and then we can press enter or if you want to give
the sequence number,
for example, like nine, if that's where you want to start it, you can. Then if
you do show route map,
we have sequence number nine. Otherwise, it would auto sequence for us. So for
this first sequence of
nine, we're going to go ahead and match on IP address and it's going to be
access list 103. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
access list 103. So
traffic if it's TCP traffic layer four, that's going to match regardless of
source or destination.
And if there's a match, we want to set the next hop to you 10.0.34.4. Let's
take a look at our
topology real quick and 10 0 34.4 is indeed the next top address there at our
four. We can verify
that by going to our four and doing a show IP interface brief. And right there,
it's confirming its
IP address of 10.0.34.4 on its fast Ethernet 4/1, which matches up with our top
ology. Fantastic. So
let's go back to our three. So we'll set the next hop and then we're going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's go back to our three. So we'll set the next hop and then we're going to
go ahead and apply
this policy to the interface. So if we look at our topology, the interface, the
inbound interface,
for traffic coming from PC7 for our test, would be fast Ethernet 4/1. Now if we
get thought
traffic would also be coming in from gig 1 0 or 0 3/2, we could also apply that
policy to those
interfaces as well. But for the demo, we want to apply this to just FA 4/1. So
on our three, we'll go
into interface config for FA 4/1. And here in interface configuration mode, we
use the command
IP policy and then the keyword route map and then the name of our route map, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
IP policy and then the keyword route map and then the name of our route map,
which is called
PBR-TCP. So I'm going to copy paste that so I don't have a typo and press enter
and it's done.
Now to verify our work, we can do a show access list. So there's our ACL. So
there's our route map.
Fantastic. And we can do a show IP policy to verify where that route map is
applied. So our route
map called PBR-TCP is applied to FA 4/1. So any traffic coming inbound or ing
ress on that interface
is going to be considered against that policy. And if it matches, it's going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is going to be considered against that policy. And if it matches, it's going to
be policy-based
routed using the next top of 10.0.34.4. Here we can also do a debug of IP
policy and press enter
and that will show us in the output whether or not packets are being policy-
based routed or if they're
missing that policy and they're just being forwarded based on the normal
routing table. So let's go
back to PC7 and let's go ahead and do our first trace to 6666 with protocol
number 1, which is
ICMP. So this one should take the normal path because it's not being policy-
based routed.
If we go back to R3, here we can see from the debug output that it is normal WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we go back to R3, here we can see from the debug output that it is normal
forwarding because
it didn't match the policy. So let's go back to PC7, hit the upper key a couple
times and let's go
ahead and do the trace once again with this time with protocol 6, which is TCP
and this should be
policy-based routed. So R1 and R2 should be completely avoided and the packet
should go from R3
directly over to R4. So let's go ahead and test that and sure enough from R7 to
R5 and then to R3
and then directly over to R4 until it went to R6. And then if we go back to R3 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then directly over to R4 until it went to R6. And then if we go back to R3
and look at the output
for the debug, notice that we have policy-based routing indicated here in the
debug output.
It's showing us we have that policy applied to FA4/1 so we'll go to interface
for interface FA4/1.
And then we'll say no and then I'll go ahead and still be removed that and that
way we can have our
normal routing table restored. So if we go back to PC7 and we hit the upper key
and do that same
trace again, now once again it's going through R1 and R2 before it's being sent
over to R4 and that's
based on the normal routing tables of all the routers in our topology. And in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
based on the normal routing tables of all the routers in our topology. And in
the next video,
I'd like to walk into an example, not just one, next top is being set based on
a set of conditions,
but two. And we'll also include source and destination as well as layer four
protocol in that decision
process. So I'll see you in the next video in just a moment.