cisco policy-based routing

PBR(policy-based route,原則型路由)
可根據指定的條件改變路由目地

PBR用法如下
1
在介面上套用route-map
(config-if)# ip [local] policy route-map < map-name>

[local] 讓router本身建立的封包也使用PBR,預設不使用
2
設定route-map的動作
(config)# route-map < map-name> permit
(config-router-map)# match ip address < acl>
(config-router-map)# set < set-action>

< set-action>主要可設定的有以下
 set [default] ip next-hop [recursive] < ip1 [ip2 [ip...]]> 到直連網路的ip1位址,若沒有則到ip2,...
  recursive:表示到非直連網路的IP   
 set [default] interface < int1 [int2 [int...]]> 到直連網路的介面1,若沒有則到介面2,...
  有default:先以一般IP路由程序,路徑失敗時才使用PBR
  無default:先使用PBR,路徑失敗才使用一般IP路由程序
 set ip precedence < value>
 set ip tos < value>

3
設定符合route-map的參數
(config)#access-list < acl-option>
ps:
route-map預設最後為deny,符合deny的封包會進入一般的ip路由程序
ex:
當封包是從10.1.1.2進入fa0/0到10.1.3.0/24時,就將封包的next-hop改為10.1.10.4
(config)# interface Fa0/0
(config-if)# ip address 10.1.1.5 255.255.255.0
(config-if)# ip policy route-map mapname
!
(config)# route-map mapname permit
(config-route-map)# match ip address 102
(config-route-map)# set ip next-hop 10.1.10.4
!
(config)# access-list 102 permit ip host 10.1.1.2 10.1.3.0 0.0.0.255

 

... 

# show ip policy
Interface Route map
Fa0/0 map1

# show route-map
route-map map1, permit, sequence 10
Match clauses:
ip address (access-lists): 102
Set clauses:
ip next-hop 10.1.10.4
Policy routing matches: 12 packets, 720 bytes
ps:
PBR的policy routing match數量一直沒增加時,可先檢查ACL的log 

# debug ip policy
*Sep 13 17:47:31.685: IP: s=10.1.1.2 (FastEthernet0/0), d=10.1.3.90, len 28, policy match
*Sep 13 17:47:31.685: IP: route map mapname, item 10, permit
*Sep 13 17:47:31.685: IP: s=10.1.1.2 (FastEthernet0/0), d=10.1.3.90 (Serial0/0/1),len 28, policy routed
*Sep 13 17:47:31.685: IP: FastEthernet0/0 to Serial0/0/1 10.1.10.4

..............................

設定路徑追蹤ip sla運作元
當ip sla運作元傳回狀態為ok,使tracking object為up時,該路徑才會運作
1建立追蹤物件
(config)# track < track-id> ip sla < sla-id> [state|reachability]
2設定路徑使用蹤物件
靜態路徑設定方式
(config)# ip route < dst mask> < int|next-hop> track < track-id>
PBR設定方式
(config)# route-map < map-name> permit
(config-route-map)# match ip address < acl>
(config-route-map)# set ip next-hop verify-availability < dst> 1 track < track-id>

延遲設定
(config)# delay < down < sec>|up < sec>>
定義sla狀態變動之後多久時間,才讓tracking object改變其狀態,以防止route flapping

ex:
設定靜態路徑10.1.234.0/24追蹤物件2狀態,而物件2以ip sla 11統計結果決定up或down
(config)# track 2 ip sla 11 state
(config-track)# delay up 90 down 90
(config)# ip route 10.1.200.0 255.255.255.0 s0/0/1 track 2
ex:
當封包是從10.1.1.2進入fa0/0到10.1.3.0/24時,就將封包的next-hop改為10.1.10.4
同時使用物件追蹤2
(config)# interface Fa0/0
(config-if)# ip address 10.1.1.5 255.255.255.0
(config-if)# ip policy route-map map-name
!
(config)# route-map map-name permit
(config-route-map)# match ip address 102
(config-route-map)# set ip next-hop verify-availability 10.1.10.4 1 track 2
!
(config)# access-list 102 permit ip host 10.1.1.2 10.1.3.0 0.0.0.255

 

# show track
Track 2
 IP SLA 11 state       //物件2以ip sla 11統計結果決定up或down
 State is Up         //tracking object目前狀態為up
  1 change, last change 01:24:14
 Delay up 90 secs, down 90 secs //延遲設定90秒
 Latest operation return code: OK //sla最後傳回的狀態為ok
 Latest RTT (millisecs) 7
 Tracked by:
  STATIC-IP-ROUTING 0 //被靜態路徑追蹤
Track 3
 IP SLA 12 state //物件3以ip sla 12統計結果決定up或down
  State is Down //目前狀態為down
   2 changes, last change 00:00:15
  Delay up 90 secs, down 90 secs
  Latest operation return code: No connection //最後狀態為no connectioin
  Tracked by:
   ROUTE-MAP 0 //被PBR追蹤
ps:
物件從up到down時會產生以下訊息
*Sep 13 22:51:33.322: %TRACKING-5-STATE: 3 ip sla 12 state Up->Down

2012-08-19 11:14:22發表 0000-00-00 00:00:00修改   

數據分析
程式開發
計算機組織與結構
資料結構與演算法
Database and MySql
manage tool
windows
unix-like
linux service
network
network layer3
network layer2
network WAN
network service
作業系統
數位鑑識
資訊安全解決方案
資訊安全威脅
Cisco security
Cisco network
Cisco layer3

Cisco layer2



  登入      [牛的大腦] | [單字我朋友] Powered by systw.net