Cisco PBR

Base routing decision on rules, rather than routing protocol and learned routed.
RISK: Hard to maintain, Can black hole traffic if network topology changes, as policy is fixed.
Debug:
- debug ip policy
Example, applied to eth0, matches traffic entering, and forces it to eth1 if acl matches.
- Note: The log keyword in access-list command is not supported by PBR.

interface Ethernet0
 ip address 172.16.1.1 255.255.255.0
 no ip directed-broadcast
 ip policy route-map net-10
!
access-list 111 permit ip 10.0.0.0 0.255.255.255 any
!
route-map net-10 permit 10
 match ip address 111
 set interface Ethernet1    !!<<Only works if arp can resolve.>>!!
 !!or!!set ip next-hop 172.2.1.1  !!<<Better forwards to next hop router.>>!!
!
route-map net-10 permit 20
!

Note:
- Policy Based Routing for encrypted traffic
  - Forward the decrypted traffic to a loopback interface in order to route the encrypted traffic based on policy routing and then do PBR on that interface. If the enrypted traffic is passed over a VPN tunnel then disable ip cef on the interface, and terminate the vpn tunnel.
- Enables fast switching of PBR.
  - Router(config-if)# ip route-cache policy

...

CategoryCisco