Cisco Policy-based routing

[unlimitedtech]

Policy-based routing provides a tool for forwarding and routing data packets based on policies defined by network administrators. In effect, it is a way to have the policy override routing protocol decisions. Policy-based routing includes a mechanism for selectively applying policies based on access list, packet size or other criteria. The actions taken can include routing packets on user-defined routes, setting the precedence, type of service bits, etc.

What is the need of defining Routing Policy

Policy Based Routing (PBR) provides a flexible mechanism to customize the operation of the routing table and the flow of traffic within their networks such as more specific selection of routing paths. This can be advantageous in some network scenarios. In today's high performance internetworks, organizations need the freedom to implement packet forwarding and routing according to their own defined policies in a way that goes beyond traditional routing protocol concerns. Where administrative issues dictate that traffic be routed through specific paths, policy-based routing, introduced in Cisco Internetwork Operating System (Cisco IOS) Software Release 11.0, can provide the solution. By using policy-based routing, customers can implement policies that selectively cause packets to take different paths.

Policy routing also provides a mechanism to mark packets so that certain kinds of traffic receive differentiated, preferential service when used in combination with queuing techniques enabled through the Cisco IOS software. These queuing techniques provide an extremely powerful, simple, and flexible tool to network managers who implement routing policies in their networks.

What are the benefits of Policy-Based Routing

The benefits that can be achieved by implementing policy-based routing in the networks include:

• Source-Based Transit Provider Selection—Internet service providers and other organizations can use policy-based routing to route traffic originating from different sets of users through different Internet connections across the policy routers.
  
• Quality of Service (QOS)—Organizations can provide QOS to differentiated traffic by setting the precedence or type of service (TOS) values in the IP packet headers at the periphery of the network and leveraging queuing mechanisms to prioritize traffic in the core or backbone of the network.
  
• Cost Savings—Organizations can achieve cost savings by distributing interactive and batch traffic among low-bandwidth, low-cost permanent paths and high-bandwidth, high-cost, switched paths.
  
• Load Sharing—In addition to the dynamic load-sharing capabilities offered by destination-based routing that the Cisco IOS software has always supported, network managers can now implement policies to distribute traffic among multiple paths based on the traffic characteristics.

[unlimitedtech]

How to configure Policy-based routing

Policy-based routing (PBR) is configured in Cisco IOS Software using the route map tool. Route maps are similar to Access Control Lists (ACLs), but have these enhanced capabilities:

• Modifying certain fields in the packet
• Forwarding packets in a specified manner
• Filtering and modifying the attributes of a route

Route maps can have a sequence of statements. Each entry in a route map statement contains a combination of match and set commands. The route map statements also have a permit or deny action. For PBR, the match command defines the criteria for matching the packets based on the defined policy. The set command defines the action to be taken on the matched packets. The action could either be modifying or forwarding the packet, bypassing the normal routing based on the IP routing table. Packets that are denied by a route map statement, or those that are not matched by any statement, are forwarded normally based on the IP routing table.

To configure PBR, create a route map by issuing the route-map map-tag [permit | deny] [sequence-number] command in global configuration mode.

PBR allows the user to match packets based on the length and characteristics of a packet, using a standard or extended ACL.

To define the matching criteria based on the policy, issue these commands from route map configuration mode:

• match length minimum-length maximum-length
• match ip address {access-list-number | access-list-name}

Define a standard or extended ACL by issuing the access-list command. A single match statement may contain multiple conditions. At least one condition in the match statement must be true for that statement to be considered as a match. A route map statement may also contain multiple match statements. All match statements in the route map statement must be considered true for the route map statement to be considered matched.

Define the action to be taken on the packets that match the criteria.

For PBR, this can be done by one of these options:

• A list of interfaces through which the packets should be routed
• A list of specified next-hop IP addresses to which the packets have to be routed
• A list of default interfaces
• A list of default next-hop IP addresses

Issue these commands in route map configuration mode:

• set interface interface-type interface-number
• set ip next-hop ip-address
• set default interface interface-type interface-number
• set ip default next-hop ip-address

This command can also be used to set the IP precedence or ToS values in the packet, as shown in this example:

• set ip precedence [number | name]
• set ip tos [number]

A single set statement may contain multiple arguments. In that case, if the interface or IP address associated with the first next-hop is down, the subsequent interfaces or IP addresses are tried. The set clauses can also be used in conjunction with one another under the same route map statement, in which case they are evaluated in a specific order.

PBR is effective only for the packets that arrive on a specific interface from the network. Enable PBR on the desired interface by issuing the ip policy route-map map-tag command in interface configuration mode.

Packets that are generated by the router are not normally policy routed. To enable PBR for packets generated by the router, issue the ip local policy route-map map-tag command in global configuration mode.