15.1.3 Lab – Path Control Using PBR Answers

• Recommend

Lab – Path Control Using PBR (Answers Version)

Answers Note: Red font color or gray highlights indicate text that appears in the instructor copy only.

Topology

Addressing Table

Objectives

In this lab, you will learn how to use policy-based routing to influence path section.

Part 1: Build the Network and Configure Basic Device Settings

Part 2: Configure and Verify Routing

Part 3: Configure PBR to Provide Path Control

Part 4: Configure Local PBR to Provide Path Control

Background / Scenario

In this scenario, you want to experiment with policy-based routing (PBR) to see how it is implemented and study how it could be used to influence path selection.

Your task is to connect and configure a 3 router and 2 Layer 3 switch OSPF routing domain and verify normal path selection. You will alter the traffic flow for PC2 going to PC3 using PBR. You will also use Cisco IOS IP SLA with PBR to achieve dynamic path control. Finally, you will configure PBR for traffic originating locally on router R1.

Note: This lab is an exercise in configuring distribute lists and redistribution using ALCs, prefix lists, and route maps.

Note: The routers used with CCNP hands-on labs are Cisco 4221 with Cisco IOS XE Release 16.9.4 (universalk9 image). The switches used in the labs are Cisco Catalyst 3650 with Cisco IOS XE Release 16.9.4 (universalk9 image). Other routers, switches, and Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands available and the output produced might vary from what is shown in the labs. Refer to the Router Interface Summary Table at the end of the lab for the correct interface identifiers.

Note: Make sure that the devices have been erased and have no startup configurations. If you are unsure, contact your instructor.

Answers Note: Refer to the Answers Lab Manual for the procedures to initialize and reload devices.

Required Resources

• 3 Routers (Cisco 4221 with Cisco IOS XE Release 16.9.4 universal image or comparable)
• 2 Switches (Catalyst 3650s with Cisco IOS XE Release 16.9.4 universalk9 image).
• 1 PC (Choice of operating system with terminal emulation program installed)

Instructions

Part 1:Build the Network and Configure Basic Device Settings

In Part 1, you will set up the network topology and configure basic settings and interface addressing on routers.

Step 1:Cable the network as shown in the topology.

Attach the devices as shown in the topology diagram, and cable as necessary.

Step 2:Configure basic settings for each device.

1. Console into each device, enter global configuration mode, and apply the basic settings. The startup configurations for each device are provided below.

Open configuration window

Router R1

hostname R1

no ip domain lookup

line con 0

logging sync

exec-time 0 0

exit

banner motd # This is R1, Path Control Using PBR #

interface G0/0/0

description Connection to R2

ip add 172.16.0.2 255.255.255.252

no shut

exit

interface S0/1/0

description Serial Connection to R3

ip add 172.16.2.1 255.255.255.252

no shut

exit

interface G0/0/1

description Connection to D1

ip add 10.10.0.1 255.255.255.252

no shut

exit

Router R2

hostname R2

no ip domain lookup

line con 0

logging sync

exec-time 0 0

exit

banner motd # This is R2, Path Control Using PBR #

interface G0/0/0

description Connection to R1

ip add 172.16.0.1 255.255.255.252

no shut

exit

interface GigabitEthernet0/0/1

description Connection to R3

ip address 172.16.1.1 255.255.255.252

no shut

exit

Router R3

hostname R3

no ip domain lookup

line con 0

logging sync

exec-time 0 0

exit

banner motd # This is R3, Path Control Using PBR #

interface G0/0/0

description Connection to R2

ip add 172.16.1.2 255.255.255.252

no shut

exit

interface S0/1/0

description Serial Connection to R1

ip add 172.16.2.2 255.255.255.252

no shut

exit

interface G0/0/1

description Connection to D2

ip add 192.168.0.1 255.255.255.252

no shut

exit

Switch D1

hostname D1

no ip domain lookup

line con 0

exec-timeout 0 0

logging synchronous

exit

banner motd # This is D1, Path Control Using PBR #

interface G1/0/11

no switchport

description Connects to R1

ip address 10.10.0.2 255.255.255.252

no shut

exit

interface Loopback 1

description Interface simulates network

ip ospf network point-to-point

ip address 10.10.1.1 255.255.255.0

exit

interface Loopback 2

description Interface simulates network

ip ospf network point-to-point

ip address 10.10.2.1 255.255.255.0

exit

Switch D2

hostname D2

no ip domain lookup

line con 0

logging sync

exec-time 0 0

exit

banner motd # This is D2, Path Control Using PBR #

interface G1/0/11

no switchport

description Connects to R3

ip address 192.168.0.2 255.255.255.252

no shut

exit

interface Loopback 1

description Interface simulates network

ip ospf network point-to-point

ip address 192.168.1.1 255.255.255.0

exit

2. Save the running configuration to startup-config.

Close configuration window

Part 2:Configure and Verify Routing

In Part 2, you will implement OSPF routing for the routing domain and verify end to end routing.

Step 1:Configure Routing.

In this step, you will configure OSPF.

1. On D1, advertise the connected networks using OSPF process ID 123. Also assign D1 the router ID of 1.1.1.2 and set the reference bandwidth to recognize Gigabit Ethernet interfaces.

Open configuration window

D1(config)# ip routing

D1(config)# router ospf 123

D1(config-router)# router-id 1.1.1.2

D1(config-router)# auto-cost reference-bandwidth 1000

% OSPF: Reference bandwidth is changed.

Please ensure reference bandwidth is consistent across all routers.

D1(config-router)# network 10.10.0.0 0.0.0.3 area 0

D1(config-router)# network 10.10.1.0 0.0.0.255 area 0

D1(config-router)# network 10.10.2.0 0.0.0.255 area 0

D1(config-router)# end

Close configuration window

2. On R1, advertise the connected networks using OSPF process ID 123. Also assign R1 the router ID of 1.1.1.1 and set the reference bandwidth to recognize Gigabit Ethernet interfaces.

Open configuration window

R1(config)# router ospf 123

R1(config-router)# router-id 1.1.1.1

R1(config-router)# auto-cost reference-bandwidth 1000

% OSPF: Reference bandwidth is changed.

Please ensure reference bandwidth is consistent across all routers.

R1(config-router)# network 10.10.0.0 0.0.0.3 area 0

R1(config-router)# network 172.16.0.0 0.0.0.3 area 0

R1(config-router)# network 172.16.2.0 0.0.0.3 area 0

R1(config-router)# end

R1#

*Feb 19 17:00:40.661: %OSPF-5-ADJCHG: Process 123, Nbr 1.1.1.2 on GigabitEthernet0/0/1 from LOADING to FULL, Loading Done

Close configuration window

3. On R2, advertise the connected networks using OSPF process ID 123. Also assign R2 the router ID of 2.2.2.1 and set the reference bandwidth to recognize Gigabit Ethernet interfaces.

Open configuration window

R2(config)# router ospf 123

R2(config-router)# router-id 2.2.2.1

R2(config-router)# auto-cost reference-bandwidth 1000

% OSPF: Reference bandwidth is changed.

Please ensure reference bandwidth is consistent across all routers.

*Feb 19 17:02:34.016: %OSPF-6-DFT_OPT: Protocol timers for fast convergence areEnabled.172.

R2(config-router)# network 172.16.0.0 0.0.0.3 area 0

R2(config-router)# network 172.16.1.0 0.0.0.3 area 0

R2(config-router)# end

R2#

*Feb 19 17:02:42.460: %OSPF-5-ADJCHG: Process 123, Nbr 1.1.1.1 on GigabitEthernet0/0/0 from LOADING to FULL, Loading Done

Close configuration window

4. On R3, advertise the connected networks using OSPF process ID 123. Also assign R3 the router ID of 3.3.3.1 and set the reference bandwidth to recognize Gigabit Ethernet interfaces.

Open configuration window

R3(config)# router ospf 123

R3(config-router)# router-id 3.3.3.1

R3(config-router)# auto-cost reference-bandwidth 1000

% OSPF: Reference bandwidth is changed.

Please ensure reference bandwidth is consistent across all routers.

R3(config-router)# network 192.168.0.0 0.0.0.3 area 0

R3(config-router)# network 172.16.1.0 0.0.0.3 area 0

R3(config-router)# network 172.16.2.0 0.0.0.3 area 0

R3(config-router)# end

R3#

*Feb 19 17:03:56.362: %OSPF-5-ADJCHG: Process 123, Nbr 1.1.1.1 on Serial0/1/0 from LOADING to FULL, Loading Done

R3#

*Feb 19 17:09:38.978: %OSPF-5-ADJCHG: Process 123, Nbr 2.2.2.1 on GigabitEthernet0/0/0 from LOADING to FULL, Loading Done

Close configuration window

5. On D2, advertise the connected networks using OSPF process ID 123. Also assign D2 the router ID of 3.3.3.2 and set the reference bandwidth to recognize Gigabit Ethernet interfaces.

Open configuration window

D2(config)# ip routing

D2(config)# router ospf 123

D2(config-router)# router-id 3.3.3.2

D2(config-router)# auto-cost reference-bandwidth 1000

% OSPF: Reference bandwidth is changed.

Please ensure reference bandwidth is consistent across all routers.

D2(config-router)# network 192.168.0.0 0.0.0.3 area 0

D2(config-router)# network 192.168.1.0 0.0.0.255 area 0

D2(config-router)# end

D2#

*Feb 19 17:29:46.627: %OSPF-5-ADJCHG: Process 123, Nbr 3.3.3.1 on GigabitEthernet1/0/11 from LOADING to FULL, Loading Done

Close configuration window

Step 2:Verify OSPF routing

1. Before configuring PBR, verify the current routing table on all devices. All routing tables look accurate.

Open configuration window

D1# show ip route ospf | begin Gateway

Gateway of last resort is not set

172.16.0.0/30 is subnetted, 3 subnets

O172.16.0.0 [110/2] via 10.10.0.1, 00:11:36, GigabitEthernet1/0/11

O172.16.1.0 [110/3] via 10.10.0.1, 00:10:10, GigabitEthernet1/0/11

O172.16.2.0 [110/497] via 10.10.0.1, 00:11:36, GigabitEthernet1/0/11

192.168.0.0/30 is subnetted, 1 subnets

O192.168.0.0 [110/4] via 10.10.0.1, 00:09:57, GigabitEthernet1/0/11

O192.168.1.0/24 [110/14] via 10.10.0.1, 00:09:57, GigabitEthernet1/0/11

D2# show ip route ospf | begin Gateway

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks

O10.10.0.0/30 [110/4] via 192.168.0.1, 00:03:55, GigabitEthernet1/0/11

O10.10.1.0/24 [110/5] via 192.168.0.1, 00:03:55, GigabitEthernet1/0/11

O10.10.2.0/24 [110/5] via 192.168.0.1, 00:03:55, GigabitEthernet1/0/11

172.16.0.0/30 is subnetted, 3 subnets

O172.16.0.0 [110/3] via 192.168.0.1, 00:03:55, GigabitEthernet1/0/11

O172.16.1.0 [110/2] via 192.168.0.1, 00:03:55, GigabitEthernet1/0/11

O172.16.2.0 [110/499] via 192.168.0.1, 00:03:55, GigabitEthernet1/0/1

R1# show ip route ospf | begin Gateway

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 4 subnets, 3 masks

O10.10.1.0/24 [110/11] via 10.10.0.2, 00:12:21, GigabitEthernet0/0/1

O10.10.2.0/24 [110/11] via 10.10.0.2, 00:12:21, GigabitEthernet0/0/1

172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks

O172.16.1.0/30 [110/2] via 172.16.0.1, 00:10:55, GigabitEthernet0/0/0

192.168.0.0/30 is subnetted, 1 subnets

O192.168.0.0 [110/3] via 172.16.0.1, 00:10:42, GigabitEthernet0/0/0

O192.168.1.0/24 [110/13] via 172.16.0.1, 00:10:42, GigabitEthernet0/0/0

R2# show ip route ospf | begin Gateway

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks

O10.10.0.0/30 [110/2] via 172.16.0.2, 00:12:26, GigabitEthernet0/0/0

O10.10.1.0/24 [110/12] via 172.16.0.2, 00:12:26, GigabitEthernet0/0/0

O10.10.2.0/24 [110/12] via 172.16.0.2, 00:12:26, GigabitEthernet0/0/0

172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks

O172.16.2.0/30

[110/497] via 172.16.0.2, 00:12:26, GigabitEthernet0/0/0

192.168.0.0/30 is subnetted, 1 subnets

O192.168.0.0 [110/2] via 172.16.1.2, 00:11:22, GigabitEthernet0/0/1

O192.168.1.0/24 [110/12] via 172.16.1.2, 00:11:22, GigabitEthernet0/0/1

R3# show ip route ospf | begin Gateway

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks

O10.10.0.0/30 [110/3] via 172.16.1.1, 00:12:56, GigabitEthernet0/0/0

O10.10.1.0/24 [110/13] via 172.16.1.1, 00:12:56, GigabitEthernet0/0/0

O10.10.2.0/24 [110/13] via 172.16.1.1, 00:12:56, GigabitEthernet0/0/0

172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks

O172.16.0.0/30 [110/2] via 172.16.1.1, 00:12:56, GigabitEthernet0/0/0

O192.168.1.0/24 [110/11] via 192.168.0.2, 00:12:44, GigabitEthernet0/0/1

Step 3:Verify end-to-end connectivity and path taken

1. From any device, verify connectivity to all configured destinations using the following TCL script. All pings should be successful. Troubleshoot if necessary.

tclsh

foreach address {

10.10.0.1

10.10.0.2

10.10.1.1

10.10.2.1

172.16.0.1

172.16.0.2

172.16.1.1

172.16.1.2

172.16.2.1

172.16.2.2

192.168.0.1

192.168.0.2

192.168.1.1

} { ping $address }

close configuration window

2. On D1, ping the D2 Loopback interface 192.168.1.1 address from the Lo1 interface as shown. The pings should be successful.

Open configuration window

D1# ping 192.168.1.1 source 10.10.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

Packet sent with a source address of 10.10.1.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/3 ms

3. Next, identify the path taken to D2 Lo1 interface using the traceroute command as shown. Notice that the path taken for the packets sourced from the D1 Lo1 LAN is going through R1 –> R2 –> R3 –> D2.

D1# traceroute 192.168.1.1 source 10.10.1.1

Type escape sequence to abort.

Tracing the route to 192.168.1.1

VRF info: (vrf in name/id, vrf out name/id)

1 10.10.0.1 2 msec 2 msec 2 msec

2 172.16.0.1 2 msec 2 msec 2 msec

3 172.16.1.2 2 msec 2 msec 2 msec

4 192.168.0.2 3 msec *3 msec

Question:

Why is the path not taking the shorter R1 –> R3 –> D2 path?

Type your answers here.

Because the serial interfaces between routers R1 and R3 are using a slower serial link, giving it a higher metric. All other interfaces are faster Gigabit Ethernet producing lower (and preferred) metrics.

4. Now ping and traceroute the D2 Lo1 interface from the D1 Loopback 2 interface as shown. It is also taking the same path.

D1# ping 192.168.1.1 source lo 2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

Packet sent with a source address of 10.10.2.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/4 ms

D1# traceroute 192.168.1.1 source lo 2

Type escape sequence to abort.

Tracing the route to 192.168.1.1

VRF info: (vrf in name/id, vrf out name/id)

1 10.10.0.1 2 msec 2 msec 1 msec

2 172.16.0.1 1 msec 2 msec 1 msec

3 172.16.1.2 2 msec 2 msec 2 msec

4 192.168.0.2 3 msec *3 msec

Close configuration window

5. Display the OSPF routes in the routing table of R1. R1 forwards all packets destined to the 192.168.1.0/24 network out of its G0/0/0 interface to R2.

Open configuration window

R1# show ip route ospf | begin Gateway

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 4 subnets, 3 masks

O10.10.1.0/24 [110/2] via 10.10.0.2, 00:19:56, GigabitEthernet0/0/1

O10.10.2.0/24 [110/2] via 10.10.0.2, 00:19:56, GigabitEthernet0/0/1

172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks

O172.16.1.0/30 [110/2] via 172.16.0.1, 00:18:50, GigabitEthernet0/0/0

192.168.0.0/30 is subnetted, 1 subnets

O192.168.0.0 [110/3] via 172.16.0.1, 00:18:37, GigabitEthernet0/0/0

O192.168.1.0/24 [110/4] via 172.16.0.1, 00:18:33, GigabitEthernet0/0/0

6. Display how R1 learned about the 192.168.1.0 network. R1 learned of the network from R2 (i.e., 172.16.0.1) who originally learned it from D2 (i.e., 3.3.3.2).

R1# show ip route 192.168.1.0

Routing entry for 192.168.1.0/24

Known via “ospf 123“, distance 110, metric 4, type intra area

Last update from 172.16.0.1 on GigabitEthernet0/0/0, 00:20:27 ago

Routing Descriptor Blocks:

* 172.16.0.1, from 3.3.3.2, 00:20:27 ago, via GigabitEthernet0/0/0

Route metric is 4, traffic share count is 1

close configuration window

Part 3:Configure PBR to Provide Path Co3ntrol

Recall that route maps can be used for:

• Redistribution – Route maps provide more options and flexibility to the redistribute command.
• Policy-based routing (PBR) – PBR allows an administrator to define routing policy other than basic destination-based routing using the routing table. The route map is applied to an interface using the ip policy route-map interface configuration command.
• BGP – Route maps are the primary tools for implementing BGP policy and allows an administrator to do path control and provide sophisticated manipulation of BGP path attributes. The route map is applied using the BGP neighbor router configuration command.

In this part, you will use PBR to configure source-based IP routing. Specifically, you will override the default IP routing decision based on the OSPF-acquired routing information for selected IP source-to-destination flows and apply a different next-hop router.

Recall that routers normally forward packets to destination addresses based on information in their routing table. By using PBR, you can implement policies that selectively cause packets to take different paths based on source address, protocol type, or application type. Therefore, PBR overrides the router’s normal routing behavior.

Configuring PBR involves configuring a route map with match and set commands and then applying the route map to the interface.

The steps required to implement path control include the following:

• Choose the path control tool to use. Path control tools manipulate or bypass the IP routing table. For PBR, route-map commands are used.
• Implement the traffic-matching configuration, specifying which traffic will be manipulated. The match commands are used within route maps.
• Define the action for the matched traffic using set commands within route maps.
• Apply the route map to incoming traffic.

Step 1:Configure PBR on R1.

As a test, you will configure the following policy on router R1:

• All traffic sourced from D1 Lo1 LAN must take the R1 –> R2 –> R3 –> D2 path.
• All traffic sourced from D1 Lo2 LAN must take the R1 –> R3 –> D2 path.
  1. On R1, create a standard named ACL called Lo2-ACL to identify the D1 Loopback 2 (i.e., 10.10.2.0/24) LAN.

Open configuration window

R1(config)# ip access-list standard Lo2-ACL

R1(config-std-nacl)# remark ACL matches D1 Lo2 traffic

R1(config-std-nacl)# permit 10.10.2.0 0.0.0.255

R1(config-std-nacl)# exit

2. Create a route map called R1-to-R3 that matches Lo2-ACL and sets the next-hop interface to the R3 serial 0/1/0 interface.

R1(config)# route-map R1-to-R3 permit

R1(config-route-map)# description RM to forward Lo2 traffic to R3

R1(config-route-map)# match ip address Lo2-ACL

R1(config-route-map)# set ip next-hop 172.16.2.2

R1(config-route-map)# exit

3. Apply the R1-to-R3 route map to the G0/0/1 interface using the ip policy route-map command.

R1(config)# interface g0/0/1

R1(config-if)# ip policy route-map R1-to-R3

R1(config-if)# end

4. On R1, display the policy and matches using the show route-map command.

R1# show route-map

route-map R1-to-R3, permit, sequence 10

Match clauses:

ip address (access-lists): Lo2-ACL

Set clauses:

ip next-hop 172.16.2.2

Policy routing matches: 0 packets, 0 bytes

Note: There are currently no matches because no packets matching the ACL have passed through R1 G0/0/1.

5. On R1, verify that the R1-to-R3 route map has been applied to the G0/0/1 interface.

R1# show ip policy

InterfaceRoute map

Gi0/0/1R1-to-R3

Close configuration window

Step 2:Test the policy.

Now you are ready to test the policy configured on R1.

1. From D1, test the policy with the traceroute command, using D1 Lo1 interface as the source network.

Open configuration window

D1# traceroute 192.168.1.1 source lo 1

Type escape sequence to abort.

Tracing the route to 192.168.1.1

VRF info: (vrf in name/id, vrf out name/id)

1 10.10.0.1 2 msec 1 msec 1 msec

2 172.16.0.1 2 msec 2 msec 2 msec

3 172.16.1.2 2 msec 4 msec 2 msec

4 192.168.0.2 3 msec *3 msec

Notice the path taken for the packet sourced from D1 Lo 1 LAN A is still going through R1 –> R2 –> R3 –> D2.

Question:

Why is the traceroute traffic not using the R3 –> R1 path as specified in the R1-to-R3 policy?

Type your answers here.

It does not take the PBR-specified path because LAN A does not meet the criteria specified in the Lo1-ACL access list.

2. Now test the policy with the traceroute command, using D1 Lo2 interface as the source network. Now the path taken for the packet sourced from D1 Lo 2 LAN is R1 –> R3 –> D2, as expected.

D1# traceroute 192.168.1.1 source lo 2

Type escape sequence to abort.

Tracing the route to 192.168.1.1

VRF info: (vrf in name/id, vrf out name/id)

1 10.10.0.1 2 msec 2 msec 1 msec

2 172.16.2.2 3 msec 2 msec 3 msec

3 192.168.0.2 3 msec *4 msec

Close configuration window

3. On R1, display the policy and matches using the show route-map command.

Note: There are now matches to the policy because packets matching the ACL have passed through R1 G0/0/1 interface. The number of packet and bytes may differ in your implementation.

Open configuration window

R1# show route-map

route-map R1-to-R3, permit, sequence 10

Match clauses:

ip address (access-lists): Lo2-ACL

Set clauses:

ip next-hop 172.16.2.2

Policy routing matches: 5 packets, 210 bytes

Close configuration window

Part 4:Configure Local PBR to Provide Path Control

How would you policy route packets generated by a router? The answer is to configure Local PBR.

Local PBR is a feature to policy route locally generated traffic. Local PBR policies are applied to the router with the ip local policy route-map global config command.

In this part, you will configure R1 to policy route all router generated traffic over the R1 to R3 link.

Step 1:Configure Local PBR on R1.

1. Verify the path that R1 currently takes without local PBR configured. R1 sends traffic to R2 then R3 and finally D2 as expected.

Open configuration window

R1# traceroute 192.168.1.1

Type escape sequence to abort.

Tracing the route to 192.168.1.1

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.0.1 1 msec 1 msec 1 msec

2 172.16.1.2 1 msec 2 msec 1 msec

3 192.168.0.2 2 msec *2 msec

2. On R1, create a named extended ACL called R1-TRAFFIC which matches all IP generated packets from R1 and destined to the D2 192.162.1.0/24 network.

R1(config)# ip access-list extended R1-TRAFFIC

R1(config-ext–nacl)# permit ip any 192.168.1.0 0.0.0.255

R1(config-ext–nacl)# exit

3. On R1, create a route map called LOCAL-PBR that permits traffic matching the R1-TRAFFIC ACL and redirects it to the R3 172.16.2.2 interface.

R1(config)# route-map LOCAL-PBR permit

R1(config-route-map)# match ip address R1-TRAFFIC

R1(config-route-map)# set ip next-hop 172.16.2.2

R1(config-route-map)# exit

4. Create a local PBR policy that matches the LOCAL-PBR route map.

R1(config)# ip local policy route-map LOCAL-PBR

R1(config)# exit

Step 2:Test Local PBR on R1.

1. Verify the path taken by R1 to reach the 192.168.1.0/24 LAN. The traffic generated by R1 and going to 192.168.1.0/24 is now policy routed directly to R3 (i.e., 172.16.2.2).

R1# traceroute 192.168.1.1

Type escape sequence to abort.

Tracing the route to 192.168.1.1

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.2.2 2 msec 1 msec 2 msec

2 192.168.0.2 2 msec *2 msec

2. Verify the path taken by R1 to reach other networks. The traffic takes the normal OSPF generated path and is not policy routed.

R1# traceroute 192.168.0.2

Type escape sequence to abort.

Tracing the route to 192.168.0.2

VRF info: (vrf in name/id, vrf out name/id)

1 172.16.0.1 1 msec 1 msec 1 msec

2 172.16.1.2 1 msec 2 msec 1 msec

3 192.168.0.2 4 msec *2 msec

3. Verify the route-map counters. The local PBR policy has matched packets.

Note: The number of packets and bytes may differ in your implementation.

R1# show route-map

route-map R1-to-R3, permit, sequence 10

Match clauses:

ip address (access-lists): Lo2-ACL

Set clauses:

ip next-hop 172.16.2.2

Policy routing matches: 6 packets, 252 bytes

route-map LOCAL-PBR, permit, sequence 10

Match clauses:

ip address (access-lists): ICMP-TRAFFIC

Set clauses:

ip next-hop 172.16.2.2

Policy routing matches: 32 packets, 2384 bytes

Close configuration window

Router Interface Summary Table

Note: To find out how the router is configured, look at the interfaces to identify the type of router and how many interfaces the router has. There is no way to effectively list all the combinations of configurations for each router class. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device. The table does not include any other type of interface, even though a specific router may contain one. An example of this might be an ISDN BRI interface. The string in parenthesis is the legal abbreviation that can be used in Cisco IOS commands to represent the interface.

End of document

Device Configs – Final

Router R1

R1# show run

Building configuration…

Current configuration : 4180 bytes

!

version 16.9

service timestamps debug datetime msec

service timestamps log datetime msec

platform qfp utilization monitor load 80

no platform punt-keepalive disable-kernel-core

!

hostname R1

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

no ip domain lookup

!

login on-success log

!

subscriber templating

!

multilink bundle-name authenticated

!

!

spanning-tree extend system-id

!

redundancy

mode none

!

interface GigabitEthernet0/0/0

description Connection to R2

ip address 172.16.0.2 255.255.255.252

negotiation auto

!

interface GigabitEthernet0/0/1

description Connection to D1

ip address 10.10.0.1 255.255.255.252

ip policy route-map R1-to-R3

negotiation auto

!

interface Serial0/1/0

description Serial Connection to R3

ip address 172.16.2.1 255.255.255.252

!

interface Serial0/1/1

!

router ospf 123

router-id 1.1.1.1

auto-cost reference-bandwidth 1000

network 10.10.0.0 0.0.0.3 area 0

network 172.16.0.0 0.0.0.3 area 0

network 172.16.2.0 0.0.0.3 area 0

!

ip local policy route-map LOCAL-PBR

ip forward-protocol nd

ip http server

ip http authentication local

ip http secure-server

!

ip access-list standard Lo2-ACL

remark ACL matches D1 Lo2 traffic

permit 10.10.2.0 0.0.0.255

!

ip access-list extended R1-TRAFFIC

permit ip any 192.168.1.0 0.0.0.255

!

route-map R1-to-R3 permit 10

description RM to forward Lo2 traffic to R3

match ip address Lo2-ACL

set ip next-hop 172.16.2.2

!

route-map LOCAL-PBR permit 10

match ip address R1-TRAFFIC

set ip next-hop 172.16.2.2

!

control-plane

!

banner motd ^C This is R1, Path Control Using PBR ^C

!

line con 0

exec-timeout 0 0

logging synchronous

transport input none

stopbits 1

line aux 0

stopbits 1

line vty 0 4

login

!

end

Router R2

R2# show run

Building configuration…

Current configuration : 3565 bytes

!

version 16.9

service timestamps debug datetime msec

service timestamps log datetime msec

platform qfp utilization monitor load 80

no platform punt-keepalive disable-kernel-core

!

hostname R2

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

no ip domain lookup

!

login on-success log

!

subscriber templating

!

multilink bundle-name authenticated

!

spanning-tree extend system-id

!

redundancy

mode none

!

interface GigabitEthernet0/0/0

description Connection to R1

ip address 172.16.0.1 255.255.255.252

negotiation auto

!

interface GigabitEthernet0/0/1

description Connection to R3

ip address 172.16.1.1 255.255.255.252

negotiation auto

!

router ospf 123

router-id 2.2.2.1

auto-cost reference-bandwidth 1000

network 172.16.0.0 0.0.0.3 area 0

network 172.16.1.0 0.0.0.3 area 0

!

ip forward-protocol nd

ip http server

ip http authentication local

ip http secure-server

!

control-plane

!

banner motd ^C This is R2, Path Control Using PBR ^C

!

line con 0

exec-timeout 0 0

logging synchronous

transport input none

stopbits 1

line aux 0

stopbits 1

line vty 0 4

login

!

end

Router R3

R3# show run

Building configuration…

Current configuration : 3782 bytes

!

version 16.9

service timestamps debug datetime msec

service timestamps log datetime msec

platform qfp utilization monitor load 80

no platform punt-keepalive disable-kernel-core

!

hostname R3

!

boot-start-marker

boot-end-marker

!

no aaa new-model

!

no ip domain lookup

!

login on-success log

!

subscriber templating

!

multilink bundle-name authenticated

!

spanning-tree extend system-id

!

redundancy

mode none

!

interface GigabitEthernet0/0/0

description Connection to R2

ip address 172.16.1.2 255.255.255.252

negotiation auto

!

interface GigabitEthernet0/0/1

description Connection to D2

ip address 192.168.0.1 255.255.255.252

negotiation auto

!

interface Serial0/1/0

description Serial Connection to R1

ip address 172.16.2.2 255.255.255.252

!

interface Serial0/1/1

no ip address

shutdown

!

router ospf 123

router-id 3.3.3.1

auto-cost reference-bandwidth 1000

network 172.16.1.0 0.0.0.3 area 0

network 172.16.2.0 0.0.0.3 area 0

network 192.168.0.0 0.0.0.3 area 0

!

ip forward-protocol nd

ip http server

ip http authentication local

ip http secure-server

!

control-plane

!

banner motd ^C This is R3, Path Control Using PBR ^C

!

line con 0

exec-timeout 0 0

logging synchronous

transport input none

stopbits 1

line aux 0

stopbits 1

line vty 0 4

login

!

end

Switch D1

D1# show run

Building configuration…

Current configuration : 4285 bytes

!

version 16.9

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no platform punt-keepalive disable-kernel-core

!

hostname D1

!

vrf definition Mgmt-vrf

!

address-family ipv4

exit-address-family

!

address-family ipv6

exit-address-family

!

no aaa new-model

switch 1 provision ws-c3650-24ps

!

ip routing

!

no ip domain lookup

!

login on-success log

!

license boot level ipservicesk9

!

diagnostic bootup level minimal

!

spanning-tree mode rapid-pvst

spanning-tree extend system-id

!

redundancy

mode sso

!

transceiver type all

monitoring

!

class-map match-any system-cpp-police-topology-control

description Topology control

class-map match-any system-cpp-police-sw-forward

description Sw forwarding, L2 LVX data, LOGGING

class-map match-any system-cpp-default

description Inter FED, EWLC control, EWLC data

class-map match-any system-cpp-police-sys-data

description Learning cache ovfl, High Rate App, Exception, EGR Exception, NFLSAMPLED DATA, RPF Failed

class-map match-any system-cpp-police-punt-webauth

description Punt Webauth

class-map match-any system-cpp-police-l2lvx-control

description L2 LVX control packets

class-map match-any system-cpp-police-forus

description Forus Address resolution and Forus traffic

class-map match-any system-cpp-police-multicast-end-station

description MCAST END STATION

class-map match-any system-cpp-police-multicast

description Transit Traffic and MCAST Data

class-map match-any system-cpp-police-l2-control

description L2 control

class-map match-any system-cpp-police-dot1x-auth

description DOT1X Auth

class-map match-any system-cpp-police-data

description ICMP redirect, ICMP_GEN and BROADCAST

class-map match-any system-cpp-police-stackwise–virt-control

description Stackwise Virtual

class-map match-any non-client-nrt-class

class-map match-any system-cpp-police-routing-control

description Routing control and Low Latency

class-map match-any system-cpp-police-protocol-snooping

description Protocol snooping

class-map match-any system-cpp-police-dhcp-snooping

description DHCP snooping

class-map match-any system-cpp-police-system-critical

description System Critical and Gold Pkt

!

policy-map system-cpp-policy

!

interface Loopback1

description Interface simulates network

ip address 10.10.1.1 255.255.255.0

ip ospf network point-to-point

!

interface Loopback2

description Interface simulates network

ip address 10.10.2.1 255.255.255.0

ip ospf network point-to-point

!

interface GigabitEthernet0/0

vrf forwarding Mgmt-vrf

no ip address

negotiation auto

!

interface GigabitEthernet1/0/1

!

interface GigabitEthernet1/0/2

!

interface GigabitEthernet1/0/3

!

interface GigabitEthernet1/0/4

!

interface GigabitEthernet1/0/5

!

interface GigabitEthernet1/0/6

!

interface GigabitEthernet1/0/7

!

interface GigabitEthernet1/0/8

!

interface GigabitEthernet1/0/9

!

interface GigabitEthernet1/0/10

!

interface GigabitEthernet1/0/11

description Connects to R1

no switchport

ip address 10.10.0.2 255.255.255.252

!

interface GigabitEthernet1/0/12

!

interface GigabitEthernet1/0/13

!

interface GigabitEthernet1/0/14

!

interface GigabitEthernet1/0/15

!

interface GigabitEthernet1/0/16

!

interface GigabitEthernet1/0/17

!

interface GigabitEthernet1/0/18

!

interface GigabitEthernet1/0/19

!

interface GigabitEthernet1/0/20

!

interface GigabitEthernet1/0/21

!

interface GigabitEthernet1/0/22

!

interface GigabitEthernet1/0/23

!

interface GigabitEthernet1/0/24

!

interface GigabitEthernet1/1/1

!

interface GigabitEthernet1/1/2

!

interface GigabitEthernet1/1/3

!

interface GigabitEthernet1/1/4

!

interface Vlan1

no ip address

!

router ospf 123

router-id 1.1.1.2

auto-cost reference-bandwidth 1000

network 10.10.0.0 0.0.0.3 area 0

network 10.10.1.0 0.0.0.255 area 0

network 10.10.2.0 0.0.0.255 area 0

!

ip forward-protocol nd

ip http server

ip http secure-server

!

control-plane

service-policy input system-cpp-policy

!

banner motd ^C This is D1, Path Control Using PBR ^C

!

line con 0

exec-timeout 0 0

logging synchronous

stopbits 1

line aux 0

stopbits 1

line vty 0 4

login

line vty 5 15

login

!

end

Switch D2

D2# show run

Building configuration…

Current configuration : 4126 bytes

!

version 16.9

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no platform punt-keepalive disable-kernel-core

!

hostname D2

!

vrf definition Mgmt-vrf

!

address-family ipv4

exit-address-family

!

address-family ipv6

exit-address-family

!

no aaa new-model

switch 1 provision ws-c3650-24ps

!

ip routing

!

no ip domain lookup

!

login on-success log

!

license boot level ipservicesk9

!

diagnostic bootup level minimal

!

spanning-tree mode rapid-pvst

spanning-tree extend system-id

!

redundancy

mode sso

!

transceiver type all

monitoring

!

class-map match-any system-cpp-police-topology-control

description Topology control

class-map match-any system-cpp-police-sw-forward

description Sw forwarding, L2 LVX data, LOGGING

class-map match-any system-cpp-default

description Inter FED, EWLC control, EWLC data

class-map match-any system-cpp-police-sys-data

description Learning cache ovfl, High Rate App, Exception, EGR Exception, NFLSAMPLED DATA, RPF Failed

class-map match-any system-cpp-police-punt-webauth

description Punt Webauth

class-map match-any system-cpp-police-l2lvx-control

description L2 LVX control packets

class-map match-any system-cpp-police-forus

description Forus Address resolution and Forus traffic

class-map match-any system-cpp-police-multicast-end-station

description MCAST END STATION

class-map match-any system-cpp-police-multicast

description Transit Traffic and MCAST Data

class-map match-any system-cpp-police-l2-control

description L2 control

class-map match-any system-cpp-police-dot1x-auth

description DOT1X Auth

class-map match-any system-cpp-police-data

description ICMP redirect, ICMP_GEN and BROADCAST

class-map match-any system-cpp-police-stackwise–virt-control

description Stackwise Virtual

class-map match-any non-client-nrt-class

class-map match-any system-cpp-police-routing-control

description Routing control and Low Latency

class-map match-any system-cpp-police-protocol-snooping

description Protocol snooping

class-map match-any system-cpp-police-dhcp-snooping

description DHCP snooping

class-map match-any system-cpp-police-system-critical

description System Critical and Gold Pkt

!

policy-map system-cpp-policy

!

interface Loopback1

description Interface simulates network

ip address 192.168.1.1 255.255.255.0

ip ospf network point-to-point

!

interface GigabitEthernet0/0

vrf forwarding Mgmt-vrf

no ip address

negotiation auto

!

interface GigabitEthernet1/0/1

!

interface GigabitEthernet1/0/2

!

interface GigabitEthernet1/0/3

!

interface GigabitEthernet1/0/4

!

interface GigabitEthernet1/0/5

!

interface GigabitEthernet1/0/6

!

interface GigabitEthernet1/0/7

!

interface GigabitEthernet1/0/8

!

interface GigabitEthernet1/0/9

!

interface GigabitEthernet1/0/10

!

interface GigabitEthernet1/0/11

description Connects to R3

no switchport

ip address 192.168.0.2 255.255.255.252

!

interface GigabitEthernet1/0/12

!

interface GigabitEthernet1/0/13

!

interface GigabitEthernet1/0/14

!

interface GigabitEthernet1/0/15

!

interface GigabitEthernet1/0/16

!

interface GigabitEthernet1/0/17

!

interface GigabitEthernet1/0/18

!

interface GigabitEthernet1/0/19

!

interface GigabitEthernet1/0/20

!

interface GigabitEthernet1/0/21

!

interface GigabitEthernet1/0/22

!

interface GigabitEthernet1/0/23

!

interface GigabitEthernet1/0/24

!

interface GigabitEthernet1/1/1

!

interface GigabitEthernet1/1/2

!

interface GigabitEthernet1/1/3

!

interface GigabitEthernet1/1/4

!

interface Vlan1

no ip address

!

router ospf 123

router-id 3.3.3.2

auto-cost reference-bandwidth 1000

network 192.168.0.0 0.0.0.3 area 0

network 192.168.1.0 0.0.0.255 area 0

!

ip forward-protocol nd

ip http server

ip http secure-server

!

control-plane

service-policy input system-cpp-policy

!

banner motd ^C This is D2, Path Control Using PBR ^C

!

line con 0

exec-timeout 0 0

logging synchronous

stopbits 1

line aux 0

stopbits 1

line vty 0 4

login

line vty 5 15

login

!

end

• Recommend