In this video, I'd love to walk you through an example of once again using PBR,
but this time,
let's go ahead and use a couple different sequences instead of a route map.
And so let's focus on traffic that's coming from this PC and this server. This
one's at .10
and this one's at .100. And this focus also on the target of 7777, which is the
loop back address
right here on R7. So by default, the traffic should go up to R6 and all the way
around the horn
until it goes down on the left hand side down to R7 based on the routing tables WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
until it goes down on the left hand side down to R7 based on the routing tables
on the individual
routers. And to make part of that is because these links right here are not
included in OSPF.
Now as a result, the routes to the 777 address are not reachable over the 1070
network because
these serial interfaces here are not in OSPF. So on R8, because we do have
multiple potential paths
to use, we have the path going up to R6, we have the path that goes up to R3,
and also a path that
goes over to R7, let's set up policy based running again, but this time we'll
do it based on
traffic coming from PC10, taking one path, traffic from server one, going
through another path, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
through another path,
and then traffic that does match either of those, going through the normal
routing tables.
So if the access control is going to make two entries, one that matches on
traffic,
source from PC8, and another entry for traffic sourced from server one, and PC8
is over at .10 and
server one's down here at .100. And for the protocol that's match on ICMP and
for the destination,
it'll be the loop packet rest of R7, which is 7.7.7.7. And then we'll create a
route map with two
sequences, let's use sequence 10, matching on the first ACL for PC8's traffic, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sequences, let's use sequence 10, matching on the first ACL for PC8's traffic,
then we'll make
another sequence of 20, and we'll match on the ACL that matches on the server
one traffic.
And for the first sequence of our route map, for sequence 10, if traffic
matches PC8's sourced
rest, going to 7.7.7 using ICMP, let's go ahead and set the next top to 10380.3
, which would pour the
traffic this way. So we'll say next top is 10.38.0.3. And for other traffic,
that doesn't match the first
sequence number here, but does match sequence 20, which is matching on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sequence number here, but does match sequence 20, which is matching on the
traffic coming from server one,
going to that IP address using ICMP. Let's go ahead and set the next top to 10.
780.7. And let me go
ahead and color code those as well. So traffic from PC8 would go here, here,
and then down. And for
traffic coming in on GIG-00 coming in from the server, that traffic would go
like that straight across.
And for traffic that didn't match either of these two entries in our route maps
, that traffic
would just be routed as normal, going up to R6, then R4, etc. So with that in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
would just be routed as normal, going up to R6, then R4, etc. So with that in
mind, let's go to our
lab environment and let's lab this up and test it out. So back in the lab
environment here, once again,
is our topology. Great, great, great. So let's begin our configuration right
here on R8 by creating some
access control lists. So we'll go to the right router. So we'll go to the R8
tab. And here on R8,
let's do a quick show, access lists, just to see what we currently have.
Currently, we don't have any,
so we'll go ahead and create somebody going into configuration mode. And let's
create access list
101. And we'll permit ICMP traffic, fit source from host. Let's go ahead and do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
101. And we'll permit ICMP traffic, fit source from host. Let's go ahead and do
PC8 at 192.168.1.10.
Just confirm that address in our topology real quick. So PC8's address is 192.
168.1.10. Fantastic.
And the destination is going to be the 32-degree of 7.7.7.7. Just like that.
And let's create another
access control list. We'll make access list 102. That will match on the source
address of server 1,
which is at .100. And using ICMP going to the same destination address. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is at .100. And using ICMP going to the same destination address. So
since we're sitting
right here, this is server 1 that we're currently sitting at with the multi-tab
buddy. Let's first
be before we actually implement the policy. Let's go to a command prompt here
on server 1. Let's do an
IP config just to confirm our address. So here's the lab network interface card
. And its address is
192.168.1.100. And let's do a quick trace with TRAC-ERT, which is how you spell
it on a Windows computer.
We'll do a -D for don't bother doing name resolution to 7.7.7.7. And there is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll do a -D for don't bother doing name resolution to 7.7.7.7. And there is
our path through the
network going through our 8, then our 6, then our 4, our 2, our 1, our 3, our 5
finally gets to our 7.
Let's also test the path going from PC8. So there's a tab here for PC8 right
there. So we've got a PC8
and we do a trace to 7.7.7.7 and press enter. That should show us the same path
with the first
top being our 8. And we have the destination port in reachable because by
default it's using UDP. So
if we hit the up arrow key and do a -capital P space 1 that will use protocol WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if we hit the up arrow key and do a -capital P space 1 that will use protocol
number 1 which is
ICMP and that will avoid that destination port in reachable on the last top.
But the path is from
our 8, our 6, our 4, our 2, our 1, our 3, our 5 until it hits our 7. So let's
go to router 8 and
let's continue setting up our policy. So the next step would be to create a
route map. So we'll
type in route map. And I'm just going to call this one PBR and let's do a
permit and let's use
sequence 10 and then in this sequence number let's match an IP address 101 and
if that's true we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if that's true we'll
set the IP next top and let's take a look at our topology. We want the next top
for that traffic
coming from PC8 to be our 3's 0, 3-2 address which is 1038.0.3. So we'll put
that in as the next
top 10.38.0.3 and that looks great with IP exit. And then we'll do one more
sequence number,
we'll do sequence number 20. So let the arrow key a few times and we'll do
sequence 20. But this
time we want to match on IP address 102. So I'll hit the arrow key a few times
and then go ahead and
change it to 102. For this sequence number what we want to have happen is if WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
change it to 102. For this sequence number what we want to have happen is if
traffic is coming from
the server at .100 matching on access list 102 we want to go ahead and set the
next top to be 10.78.0.7.
So we'll set IP next top to 10.78.0.7 and let's just verify that's our correct
address there. So
10.78.0.7 just for granted let's go to our 7 to show IP interface brief just to
confirm that
really is the address on its 0, 3/1 interface which it is fantastic. All right
so back to R8 we go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so back to R8 we go
and here at R8 the next thing we need to do is apply this to the interface now
in our topology we
want to apply this to gig 00 here on R8. So inbound traffic that's coming from
PC8 or from server
nug if it matches the access control list as part of the route map. Once we
apply this to gig 00
have policy based routing enabled for those two specific traffic flows. So we
'll go ahead and
go to interface gig 00 and the syntax to apply is IP policy then we'll specify
the route map we
want to use and then I'm going to copy paste it right here to make sure I don't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
want to use and then I'm going to copy paste it right here to make sure I don't
have a typo
and press center and then to verify that we do a show access list to verify the
contents of our
access control list fantastic. We do a show route map you look at the contents
of our route map
with the two sequences so here sequence 10 if we match an ACL 101 the next top
is going to be 10.3.0.7.
0.3 if that doesn't match and we do match on sequence 20 which is looking at
access list 102 it'll
set the next top to 10.7807 and currently we have zero packets and zero bytes
for each of them because
we haven't sent traffic through yet that matches and to confirm where it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we haven't sent traffic through yet that matches and to confirm where it's
applied we can do a show
IP policy just like that and that confirms that our route map called pbr is
applied on the gig 00 interface
let's generate some traffic let's go back to the command line right here on
server one so we're
sitting right here at server one nug and in our topology that has the IP
address of 192 168 1.100 and
based on the policy based routing we just set up on our eight this trace that
we just did from
the source address of 192 168 1.100 going to 7777 if it's using ICMP which the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the source address of 192 168 1.100 going to 7777 if it's using ICMP which the
trace from windows does
use ICMP that should match and instead of going all the way around the horn
this traffic should be
policy based routed right over directly to our seven over the serial link so
let's also before we
do that let's go back to the console for our eight and let's do a debug IP
policy and there we go and
there is some traffic that's currently being forwarded it's having rejected by
the policy because
it's not matching it's traffic from dot 100 going to 192 203 2310 and another WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's not matching it's traffic from dot 100 going to 192 203 2310 and another
address of 192 12364
however that's not matching our policy that's why we have all the reject
messages so if we go back
to our command prompt here and let's go ahead and do a trace route again to
that destination press
enter all of this traffic should be matched by the policy and as a result that
's why we have the
direct path from our eight going over to our seven instead of going through
this path it was previously
and if we go back to the console for our eight we should also see it indicated
here that we had
policy based matches and as a result we had policy based routing so if we did a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
policy based matches and as a result we had policy based routing so if we did a
show route map
and press enter in those here for secos 20 it shows us we had six packets and 6
36 bytes matching
that policy and that's the traffic coming from the server at dot 100 going over
to seven seven seven
seven using ICMP so let's also test traffic from PC eight so we're going to PC
eight previously we
needed a trace using ICMP it went through the whole process it went through all
this route but
check it out now because we have the next top of dot three here it was policy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
check it out now because we have the next top of dot three here it was policy
based route it we
could also confirm that by using a different protocol so if we use something
other than ICMP let's say
for example we use TCP for that trace now we're using the normal forwarding
table because the access
control is looking specifically for ICMP traffic from our source address of PC
eight going to the
destination IP address of seven seven seven seven and so if we hit the upper
key a couple times
used ICMP again we have a shorter path through the policy based routing and if
we head over to our eight WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we head over to our eight
we can also see that we had a whole bunch of packets that were indeed policy
based route it
as shown like go ahead and turn the debugging off on all and scroll up a little
bit so as shown right
here we had a whole bunch of traffic that was policy based route it now one of
the interesting things
about policy based routing is that by default when we apply the policy to an
interface it applies
to ingress or inbound traffic going into the router on that interface but if we
want policy based
routing to apply to traffic that the router itself is generating for example it
's generating a
ping or a trace or it's reaching out with telnet or ssh another system if we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ping or a trace or it's reaching out with telnet or ssh another system if we
want that traffic
source by the router itself to be policy based routed but we need to set up
this what's called a
local policy and the great news is that in the next video i'm going to walk you
through exactly
that so i'll see you in the next video in just a moment