Catalyst 4500 Series Switch Software Configuration Guide, IOS XE 3.6.xE and IOS 15.2(2)Ex

About PBR

All packets received on an interface with PBR enabled (except those sent directly to the switch IP) are handled by enhanced packet filters known as route maps. The route maps used by PBR dictate the policy, determining to where the packets are forwarded.

Route maps are composed of statements, which can be marked as permit or deny. They are interpreted in the following ways:

• If a statement is marked as deny, the packets meeting the match criteria are sent back using the normal forwarding channels and destination-based routing is performed.
• If the statement is marked as permit and a packet matches the access-lists, then the first valid set clause is applied to that packet.

This is explained in more detail in the section Understanding Route-Maps.

You specify PBR on the incoming interface (the interface on which packets are received), not outgoing interface.

Understanding Route-Maps

PBR is implemented by applying a route-map on an incoming interface. A given interface can have only one route-map configured.

A route-map is configured at the global configuration parser mode. You can then apply this route-map on one or more interfaces (in the interface configuration parser sub-mode).

A route-map is comprised of one or more route-map statements. Each statement has a sequence number, as well as a permit or deny clause.

Each route-map statement contains match and set commands. The match command denotes the match criteria to be applied on the packet data. The set command denote the PBR action to be taken on the packet.

The following example shows a single route-map called rm-test and six route-map statements:

The numbers 21, 22,... 26 are the sequence numbers of the route-map statements.

The following topics are discussed:

• PBR Route-Map Processing Logic
• Load balancing with recursive next-hop
• PBR Route-Map Processing Logic Example

PBR Route-Map Processing Logic

When a packet is received on an interface configured with a route-map, the forwarding logic processes each route-map statement according to the sequence number.

If the route-map statement encountered is a route-map... permit statement:

• The packet is matched against the criteria in the match command. This command may refer to an ACL that may itself have one or more permit and/or deny expressions. The packet is matched against the expressions in the ACL, and a permit/deny decision is reached.
• If the decision reached is permit, then the PBR logic executes the action specified by the set command on the packet.
• If the decision reached is deny, then the PBR action (specified in the set command) is not applied. Instead the processing logic moves forward to look at the next route-map statement in the sequence (the statement with the next higher sequence number). If no next statement exists, PBR processing terminates, and the packet is routed using the default IP routing table.

If the route-map statement encountered is a route-map... deny statement:

• The packet is matched against the criteria given in the match command. This command may refer to an ACL that may itself have one or more permit and/or deny expressions. The packet is matched against the expressions in the ACL, and a permit/deny decision is reached.
• If the criteria decision is permit, then the PBR processing terminates, and the packet is routed using the default IP routing table.
• If the criteria decision is deny, then the PBR processing logic moves forward to look at the next route-map statement in the sequence (the statement with the next higher sequence number). If no next statement exists, PBR processing terminates, and the packet is routed using the default IP routing table.

Note The set command has no effect inside a route-map... deny statement.

A route-map statement can have multiple set commands, which are applied in the following priority:

set ip next-hop

set ip next-hop recursive

set interface

set default ip next-hop

set default interface

If both the set ip next-hop and set ip next-hop recursive commands are present in the same route-map statement, the next-hop set command is applied.

If the set ip next-hop command is not available then the set ip next-hop recursive command is applied.

If the set ip recursive-next-hop and the set interface command are not present, then the packet is routed using the default routing table; it is not dropped. If the packet is required to be dropped, use the set next-hop recursive command followed by a set interface null0 configuration command.

Load balancing with recursive next-hop

If multiple equal-cost routes to the subnet have been configured by the set ip next-hop recursive command, load balancing will occur only if all the adjacencies to the routes are resolved. If any of the adjacencies have not been resolved, then load balancing will not happen and only one of the routes whose adjacency is resolved will be used. If none of the adjacencies are resolved, then packets will be processed in software, resulting in at least one of the adjacencies to be resolved and programmed in hardware. PBR relies on routing protocols or other means to resolve all adjacencies and make load balancing happen.

PBR Route-Map Processing Logic Example

Consider a route-map called rm-test defined as follows:

!

• TCP packet from 61.1.1.1 to 133.3.3.1 with destination port 101

– Matches ACL 101 in sequence #21.

– PBR is switched through next-hop 21.1.1.1.

Note ACL 101 is also matched in sequence #23, but the processing doesn't reach that point

• TCP packet from 61.1.1.1 to 133.3.3.1 with destination port 102

– In sequence #21, the ACL 101 action denies this packet (because all ACLs have an implicit deny). Processing advances to sequence #22.

– In sequence #22, ACL 102 matches TCP port 102, but the ACL action is deny. Processing advances to sequence #23.

– In sequence #23, ACL 2102 matches TCP port 102, and the ACL action is permit.

– Packet is switched to output interface VLAN 23.

• TCP packet from 61.1.1.1 to 133.3.3.1 with destination port 105

– Processing moves from sequence #21 to #24, because all ACLs in these sequence numbers have a deny action for port 105.

– In sequence #25, ACL 105 has a permit action for TCP port 105.

– The route-map deny takes effect, and the packet is routed using the default IP routing table.

The Catalyst 4500 series switch supports matching route-map actions with a packet by installing entries in the TCAM that match the set of packets described by the ACLs in the match criteria of the route map. These TCAM entries point at adjacencies that either perform the necessary output actions or forward the packet to software if either hardware does not support the action or its resources are exhausted.

If the route-map specifies a set interface … action, packets that match the match statement are routed in software. Similarly, if the route-map specifies a set default interface… action and there is no matching IP route for the packet, the packet is routed in software.

Note The scale of hardware-based PBR is determined by TCAM size and the time required for the CPU to flatten the ACL before programming into hardware. The latter will noticeably increase if a PBR policy requires a considerable number of class-maps. For example, a PBR policy of 1,200 class-maps may require 60-90 minutes of "flatten" time before programming into hardware. This process may repeat if an adjacency change requires PBR reprogramming.

Using Policy-Based Routing

You can enable PBR to change the routing path of certain packets from the default path that would be chosen by IP routing. For example, you can use PBR to provide the following functionality:

• Equal access
• Protocol-sensitive routing
• Source-sensitive routing
• Routing based on interactive versus batch traffic
• Routing based on dedicated links

Some applications or traffic can benefit from source-specific routing; for example, you can transfer stock records to a corporate office on a higher-bandwidth, higher-cost link for a short time while sending routine application data, such as e-mail, over a lower-bandwidth, lower-cost link.

Note PBR configuration is only allowed on interfaces belonging to the global routing table. PBR is not supported on interfaces that belong to VRFs.

Enabling IPv4 PBR

To enable PBR, you must create a route map that specifies the match criteria and the resulting action if all of the match clauses are met. Then you must apply that route-map on a particular interface. All packets arriving on the specified interface matching the match clauses are subject to PBR.

To enable IPv4 PBR on an interface, perform this task:

Use the set commands with each other. These commands are evaluated in the order shown in Step 3 in the previous task table. A usable next hop implies an interface. Once the local switch finds a next hop and a usable interface, it routes the packet.

Refer to the section Policy-Based Routing Configuration Examples for examples of IPv4 PBR.

Use the show route-map map-tag command to display the existing route map.

Note Packet and byte counters in the output of the show route-map map-tag command are not updated.

Enabling IPv6 PBR

Note With IOS XE 3.6.0E and IOS 15.2(2)E, IPv6 PBR is not supported on Supervisor Engine 8-E.

To enable PBR, you must create a route map that specifies the match criteria and the resulting action if all of the match clauses are met. Then you must apply that route-map on a particular interface. All packets arriving on the specified interface matching the match clauses are subject to PBR.

For IPv6 PBR to work on the Catalyst 4900M, Catalyst 4948E and Catalyst 4948E-F Series Switches, IPv4 and IPv6 routing must be enabled the device.

To enable IPv6 PBR on an interface, perform this task:

Note The recursive option is supported for IPv4, but not for IPv6. An interface can have either an ipv4 route map or and ipv6 route map. An interface can be bound to only one route map.

Use the set commands with each other. These commands are evaluated in the order shown in Step 3 in the previous task table. A usable next hop implies an interface. Once the local switch finds a next hop and a usable interface, it routes the packet.

Refer to the following document for IPv6 PBR configuration examples.

http://www.cisco.com/c/en/us/support/docs/ip/ip-version-6-ipv6/112218-policy-based-routing-ipv6-configex.html

Note Packet and byte counters in the output of the show route-map map-tag command are updated only for software switched packets. Counters for hardware switched packets are not updated.

Enabling Local IPv4 and Local IPv6 PBR

Packets that are generated by the switch are not normally policy-routed. To enable local PBR for such packets, indicate which route map the switch should use by entering this command:

IPv4

IPv6

All packets originating on the switch are then subject to local PBR.

Use the show ip local policy command to display the route map used for local PBR, if one exists.

Examples of the show Command

The following show command illustrates that route map pbrv6-test has only one permit sequence.

In the example policy, IPv6 packets with an address matching the criteria defined by the access control list v6_acl are forwarded to the next hop 2006::2. If next-hop 2006::2 is unreachable, the matching packets are forwarded to 2005::2. If both next-hops are unreachable, the packets are forwarded using the routing table lookup. For packets that do not match the filter criteria, a standard routing table lookup is performed for packet forwarding.

Unsupported Commands

The following PBR commands in config-route-map mode are in the CLI but not supported in Cisco IOS for the Catalyst 4500 series switches. If you attempt to use these commands, an error message displays:

• match-length
• set ip qos and set ipv6 qos
• set ip tos and set ipv6 tos
• set ip precedence and set ipv6 precedence
• set ip df and set ipv6 df
• set ip next-hop recursive ip-address

Note The recursive option is not supported on IPv6.

Equal Access

The following example provides two sources with equal access to two different service providers. Packets arriving on interface fastethernet 3/1 from the source 1.1.1.1 are sent to the switch at 6.6.6.6 if the switch has no explicit route for the destination of the packet. Packets arriving from the source 2.2.2.2 are sent to the switch at 7.7.7.7 if the switch has no explicit route for the destination of the packet. All other packets for which the switch has no explicit route to the destination are discarded.

Note If the packets you want to drop do not match either of the first two route-map clauses, then change |
set default interface null0 to set interface null0.

Differing Next Hops

The following example illustrates how to route traffic from different sources to different places (next hops). Packets arriving from source 1.1.1.1 are sent to the next hop at 3.3.3.3; packets arriving from source 2.2.2.2 are sent to the next hop at 3.3.3.5.

Deny ACE

The following example illustrates how to stop processing a given route map sequence, and to jump to the next sequence. Packets arriving from source 1.1.1.1 skip sequence 10 and jump to sequence 20. All other packets from subnet 1.1.1.0 follow the set statement in sequence 10.