{"id":855,"date":"2009-10-12T19:47:52","date_gmt":"2009-10-13T01:47:52","guid":{"rendered":"http:\/\/gregsowell.com\/?p=855"},"modified":"2009-10-12T19:47:52","modified_gmt":"2009-10-13T01:47:52","slug":"cisco-policy-based-routing-%e2%80%93-violate-route-table-%e2%80%93-send-some-traffic-one-way-and-everything-else-the-other","status":"publish","type":"post","link":"https:\/\/gregsowell.com\/?p=855","title":{"rendered":"Cisco Policy Based Routing \u2013 Violate Route Table \u2013 Send Some Traffic One Way and Everything Else The Other"},"content":{"rendered":"<table border=\"0\">\n<tbody>\n<tr>\n<td>The idea in this scenario is as follows: You have two ISPs. You want all of your user\u2019s web traffic to exit and enter ISP1 and everything else to exit and enter ISP2. You also need the ISP connections to backup each other in the case of a failure of either.<\/p>\n<p>Here\u2019s our lovely diagram for this exercise.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" title=\"pbr\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2009\/10\/pbr.JPG\" alt=\"pbr\" width=\"850\" height=\"235\" \/><\/p>\n<div id=\"attachment_936\" style=\"width: 860px;\">\n<p-caption-text><\/p-caption-text>\n<p-caption-text><\/p-caption-text>PBR Diagram<\/div>\n<p>You will notice that I have a firewall in place. This configuration works with or without the firewall. You can ditch the firewall and move the VLAN interfaces to the router. I added the firewall, because the question was asked from someone who has this configuration. So, in this configuration with the firewall, we won\u2019t do any NATing in the firewall, it will all be done in the router. This will allow me to be as granular as possible. We are also assuming that each ISP is giving you a single static public IP.<\/p>\n<p>So, what is Policy Based Routing(PBR)? This allows you to put a policy incoming on an interface that will move or manipulate traffic in a variety of ways. <a title=\"blocked::http:\/\/www.cisco.com\/en\/US\/products\/ps6599\/products_white_paper09186a00800a4409.shtml Cisco PBR\" href=\"http:\/\/www.cisco.com\/en\/US\/products\/ps6599\/products_white_paper09186a00800a4409.shtml\" target=\"_blank\">Here\u2019s<\/a> the quick and dirty from Cisco.<\/p>\n<p>We are going to:<\/p>\n<ul>\n<li>Specify a default route for ISP2<\/li>\n<li>Create an ACL that will specify which traffic we want to exit ISP1<\/li>\n<li>Create a route-map that will match our ACL and divert that traffic to ISP1<\/li>\n<li>We will then apply the route-map to the incoming interface of the source traffic<\/li>\n<\/ul>\n<p>Router Config:<br \/>\n<!--DEVFMTCODE--><\/p>\n<pre title=\"Text\">\r\n<div>\r\n<ol>\r\n\t<li>int fa0\/0<\/li>\r\n\t<li>ip address 192.168.0.2 255.255.255.0<\/li>\r\n\t<li>desc Inside-to-firewall<\/li>\r\n\t<li>!configure this interface as inside for NAT<\/li>\r\n\t<li>ip NAT inside<\/li>\r\n\t<li>!add the route-map on the traffic's incoming interface<\/li>\r\n\t<li>ip policy route-map alternate-routing<\/li>\r\n\t<li>!<\/li>\r\n\t<li>int fa0\/1<\/li>\r\n\t<li>ip address 1.1.1.1 255.255.255.252<\/li>\r\n\t<li>desc Outside-to-ISP1<\/li>\r\n\t<li>!setup ip NAT for outside<\/li>\r\n\t<li>ip NAT outside<\/li>\r\n\t<li>!<\/li>\r\n\t<li>int fa0\/2<\/li>\r\n\t<li>ip address 2.2.2.2 255.255.255.252<\/li>\r\n\t<li>desc Outside-to-ISP2<\/li>\r\n\t<li>!setup ip NAT for outside<\/li>\r\n\t<li>ip NAT outside<\/li>\r\n\t<li>!<\/li>\r\n\t<li>!NAT AVL.  Specify what should be NAT'd.<\/li>\r\n\t<li>ip access-list ext NAT<\/li>\r\n\t<li> permit ip 192.168.0.0 0.0.255.255<\/li>\r\n\t<li>!<\/li>\r\n\t<li>!specify interesting traffic for our policy<\/li>\r\n\t<li>ip access-list ext web-traffic-users<\/li>\r\n\t<li> permit tcp 192.168.20.0 0.0.0.255 any eq 80<\/li>\r\n\t<li> permit tcp 192.168.20.0 0.0.0.255 any eq 443<\/li>\r\n\t<li>!<\/li>\r\n\t<li>!setup the NAT statements for our outside interfaces<\/li>\r\n\t<li>ip NAT inside source list NAT int fa0\/1<\/li>\r\n\t<li>ip NAT inside source list NAT int fa0\/2<\/li>\r\n\t<li>!<\/li>\r\n\t<li>!default route out ISP2<\/li>\r\n\t<li>ip route 0.0.0.0 0.0.0.0 2.2.2.1<\/li>\r\n\t<li>!floating static default route out ISP1<\/li>\r\n\t<li>ip route 0.0.0.0 0.0.0.0 1.1.1.2 254<\/li>\r\n\t<li>!<\/li>\r\n\t<li>route-map alternate-routing permit 10<\/li>\r\n\t<li> match ip address web-traffic-users !Match the AVL web-traffic<\/li>\r\n\t<li> set ip next-hop 1.1.1.2 2.2.2.1 !set the next hop for this traffic out ISP1, if it fails, use ISP2<\/li>\r\n<\/ol>\r\n<\/div><\/pre>\n<p><!--END_DEVFMTCODE--> <\/p>\n<p>On line 26, we configure an ACL that specifies which traffic will be grabbed and sent out ISP1.<\/p>\n<p>Line 39 begins our route-map. These guys are the heart of our configuration. You name it, specify permit and give it a sequence number. After that we provide a match statement. Here we match the ACL we created on line 26. The action to be performed is specified with set commands. Our set command is setting the next-hop IP address for ISP1 and then secondary ISP2. The idea is if ISP1\u2019s interface is up, the user web traffic will dump out there. If ISP1 goes down, the web traffic will kick to ISP2.<\/p>\n<p>On line 35 we have the default route pointing out ISP2. This will send all traffic that direction by\u2026well\u2026default..heh. You will notice that on line 37 we have what appears to be another default route. In reality, we are using a floating static route. We have the metric for the route set to 254. What this does is make the route look undesirable, and so the ISP2 route will normally be used. If ISP2\u2019s interface goes down, then ISP2\u2019s route will go away and ISP1\u2019s route will be used. This gives us failover for both providers.<br \/>\n<strong>A note on using floating routes:<\/strong> The failover only happens if the interface goes down. What this means is that if routing in the provider\u2019s network bricks on us, we will continue to send traffic to them, because our interface never goes down, so we still have our routes pointing to them! How do we work around this? We can use IPSLA. I\u2019m not going to go into these configurations, because I\u2019ve already done this! The command sets should be almost identical for IOS as it is for ASAs. <a title=\"blocked::http:\/\/gregsowell.com\/?p=810\" href=\"http:\/\/gregsowell.com\/?p=810\">Here\u2019s the ASA article<\/a>.<\/p>\n<p>Last, on line 7 we apply the route-map to the inside interface on the router. Route-maps for PBR can only be applied inbound on interfaces. We do this because if we are going to violate the route table, we have to do it before the routing table gets hold of the traffic.<\/p>\n<p>Questions and comments are more than just welcome, they are demanded!<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>The idea in this scenario is as follows: You have two ISPs. You want all of your user\u2019s web traffic to exit and enter\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,8],"tags":[],"class_list":["post-855","post","type-post","status-publish","format-standard","hentry","category-cisco","category-networking"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/855","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=855"}],"version-history":[{"count":2,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/855\/revisions"}],"predecessor-version":[{"id":858,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/855\/revisions\/858"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=855"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}