Contents
What is PBR in BGP?
PBR is the process of using a route map to match on something more than the destination and then defining the path out of the router based on those conditions. The deny or drop is defined by the route map, not the ACL that is referenced by the route map.
Why is PBR used?
The goal of PBR is to make the network as agile as possible. By defining routing behavior based on application attributes, PBR provides flexible, granular traffic-handling capabilities for forwarding packets.
How do I set up PBR?
PBR on Cisco router can configure using following steps:
- Step1: Configure ACLs. Permit statement in ACL is what will be matched.
- Step2: Configure route map instances.
- Step3: Configure match commands.
- Step4: Configure set commands.
- Step5: Configure PBR on the interface.
- Step6: (Optional) Configure local PBR.
How to do PBR based on policy routing?
Forward the decrypted traffic to a loopback interface in order to route the encrypted traffic based on policy routing and then do PBR on that interface. If the enrypted traffic is passed over a VPN tunnel then disable ip cef on the interface, and terminate the vpn tunnel.
How to configure PBR on an interface?
To configure PBR on an interface, use the following commands beginning in global configuration mode: Command Purpose Step 1Router(config)#route-mapmap-tag[permit| deny] [sequence-number] Defines a route map to control where packets are output. This command puts the router into route-map configuration mode.
Can a debug IP packet command cause a router to lock up?
Without this access list, the debug ip packet command can generate so much output to the console that the router locks up. Use extended ACLs when you configure PBR. If no ACL is configured in order to establish the match criteria, it results in all traffic being policy-routed.
Do you need a firewall for policy routing?
The firewall translates all the packets from 10.0.0.0/8 network going to the Internet, which is however not necessary for policy routing to work. The firewall configuration below is included to provide a complete picture. However, it is not part of the policy routing issue explained in this document.