Influencing Forwarding Conduct with Coverage Based mostly Routing

It had been a scorching minute since I final put collectively a weblog, and I used to be excited about what could be an fascinating matter. Effectively, as is typical, I considered what I’d just lately run throughout, or labored on, in my “day job” as a part of the engineering crew that builds and helps the lab environments for all of the Studying at Cisco coaching supplies.

On this explicit day, I used to be reviewing the present configurations of the core community routers (layer 3 switches actually) in our information facilities. I’m pretty new to this a part of the crew, and I used to be to find that we have been leveraging Coverage Based mostly Routing to control the forwarding habits for several types of visitors. I’m certain lots of you studying this weblog are accustomed to the truth that there are at all times a number of methods to perform a activity in networking (life actually, however undoubtedly in networking). As such, policy-based routing is a software within the community engineer’s toolkit that may usually be leveraged to deal with “odd enterprise necessities.”

And with that, I had a subject to make use of for this weblog and an accompanying video to kick off a brief video collection known as “Technically Talking… with Hank Preston” on the Cisco U. by Studying and Certifications YouTube channel. Particularly, we’re going to take a look at how to configure policy-based routing to affect forwarding habits. The why I’ll depart for one more submit. 🙂

Additionally, for anybody finding out for the CCNP Enterprise certification, policy-based routing is on the ENARSI – Implementing Cisco Enterprise Superior Routing and Providers blueprint – “1.6 Configure and confirm policy-based routing.” 300-410 ENARSI is a focus examination that earns you the Cisco Licensed Specialist – Enterprise Superior Infrastructure Implementation certification.  So, it’s undoubtedly an excellent matter for the Cisco Studying weblog. Let’s dive proper in!

Setting the Stage

Earlier than we take a look at altering the standard routing and forwarding habits, let’s begin with the fundamental forwarding habits. For this exploration, I put the beneath community collectively in a Cisco Modeling Labs simulation. (Yow will discover the topology file right here.)

Network Toplogy
The community topology used on this exploration of coverage based mostly routing and forwarding habits.

This community has two small LANs separated by a primary, single space OSPF community within the center. The prices within the OSPF community have been configured to make the perfect path from R1 to R5 by R3. We are able to see that in a pair methods.

First, let’s take a look at the interface prices on R1.

R1#present ip ospf interface temporary 

Interface    PID   Space            IP Handle/Masks    Value  State Nbrs F/C
Gi0/1.200    1     0        1     DR    0/0
Gi0/1.100    1     0        1     DR    0/0
Gi0/4        1     0           110   DR    1/1
Gi0/3        1     0           1     DR    1/1
Gi0/2        1     0           100   DR    1/1

Discover the prices for interface G0/2 and G0/4 (in direction of R2 and R4) have a price of 100 and 110 respectively, whereas the price of G0/3 (in direction of R3) is only one.

And now, we’ll confirm the routing desk entry for host H3 on R1.

R1#present ip route   

Routing entry for
  Recognized through "ospf 1", distance 110, metric 3, sort intra space
  Final replace from on GigabitEthernet0/3, 00:23:02 in the past
  Routing Descriptor Blocks:
  *, from, 00:23:02 in the past, through GigabitEthernet0/3
      Route metric is 3, visitors share depend is 1

The routing desk lists the route as in direction of R3 out interface G0/3 — precisely as we’d count on.

The ultimate test might be a hint route from host H1.

H1:~$ traceroute -n

traceroute to (, 30 hops max, 46 byte packets
 1   5.534 ms  5.004 ms  3.038 ms
 2      5.528 ms  5.531 ms  4.137 ms       <- R3's G0/1 interface
 3      5.533 ms  5.656 ms  6.339 ms
 4   14.180 ms  9.787 ms  7.908 ms

And no large shocker right here, the second hop within the hint is certainly R3.

Let’s shake issues up a bit bit.

Suppose there was some purpose that you simply needed to direct visitors acquired at router R1 from host H1 destined for H3 to go by R2 . Perhaps there was some visitors evaluation that occurred on that router. Or maybe that hyperlink is extra dependable, even when slower. There are any variety of causes this may come up in a community design. The important thing half is that you simply don’t wish to change ALL forwarding habits, simply a few of it. You could have a “coverage,” so to talk, that identifies some visitors you wish to regulate. That is the place coverage based mostly routing, also known as PBR, is available in.

Coverage based mostly routing can appear sophisticated. To be truthful, if overused, it might make networks very sophisticated and arduous to take care of. Nevertheless, the technical fundamentals of PBR are fairly simple.

First, you want a solution to determine the visitors that you simply wish to apply the coverage to. Like many “matching” use circumstances in networking, that is usually carried out with an access-list. So, right here’s the entry record that I’ll use to match the visitors I’m excited about.

ip access-list prolonged H1-to-H3
  10 allow ip host host

This single line prolonged ACL is all that’s wanted. I’m matching all IP visitors from H1 to H3, however I may very well be extra particular, to a selected port as nicely. Perhaps simply net visitors (tcp/80 & tcp/443) for example.

Subsequent, a route-map is used to describe the coverage that we wish to configure. The “coverage” is made up of “match” situations to determine the visitors and “set” situations to make the “coverage based mostly modifications” to the visitors that was matched.

Right here is the route-map for my coverage instance.

route-map POLICY-BASED-ROUTING allow 10
  description Site visitors from H1 -> H3 route by R2
  match ip tackle H1-to-H3
  set ip next-hop

I’ve used the access-list I created in my “match ip tackle” command. And, I’ve indicated that when visitors “matches” this coverage, I wish to “set” the next-hop to be

And spot the primary line within the configuration instance. It ends with the quantity “10.” This quantity identifies the place within the route map that this explicit coverage entry holds.  A route-map will be made up of many coverage units – every with a “match” and “set” assertion.  On this manner, community engineers can have very granular management over how visitors is forwarded within the community.  Fairly useful proper!

Earlier than I’m going a lot farther it’s undoubtedly essential to notice that route-maps are used for extra than simply coverage based mostly routing.  The route-map assemble can be used as a part of high quality of service (QoS) configurations, routing protocol filtering, and BGP path manipulations.  So for those who discover the configuration choices out there for match and set one can find a number of different choices.  Most of those are used to be used circumstances apart from coverage based mostly routing.

The final step to finish the configuration of my coverage is to use it to the router interface. Since this coverage is about controlling visitors from the LAN linked to interface Gig0/1 on R1, that’s the place I’ll apply it.

interface Gig0/1.100
  ip coverage route-map POLICY-BASED-ROUTING

That’s it, we’ve configured coverage based mostly routing. Let’s check to see if it’s working.

We’ll begin by rerunning the identical hint route command as earlier than and evaluating the outcomes.

1:~$ traceroute -n

traceroute to (, 30 hops max, 46 byte packets
 1  7.306 ms  3.017 ms  3.337 ms
 2     3.844 ms  4.335 ms  3.688 ms      <- R2's G0/1 interface
 3     7.906 ms  5.125 ms  5.962 ms
 4   8.951 ms  8.912 ms  7.348 ms

Take a look at that, visitors is certainly going by R2 now. However let’s confirm that it’s only for visitors to H3 by hint routing the visitors to H4.

H1:~$ traceroute -n

traceroute to (, 30 hops max, 46 byte packets
 1  3.681 ms  3.153 ms  2.563 ms
 2     3.613 ms  3.185 ms  3.747 ms     <- R3's G0/1 interface
 3     5.957 ms  7.555 ms  5.040 ms
 4  14.915 ms  7.157 ms  7.853 ms

Yep, visitors from H1 to H4 is certainly nonetheless following the “customary path” by R3. However what about visitors from H2 -> H3?  Will it’s redirected by R2?

H2:~$ traceroute -n

traceroute to (, 30 hops max, 46 byte packets
 1  7.284 ms  2.840 ms  3.173 ms
 2     3.526 ms  4.514 ms  3.498 ms    <- R3's G0/1 interface
 3     6.375 ms  7.212 ms  4.900 ms
 4   6.642 ms  6.270 ms  5.884 ms

Nope, solely visitors from H1 -> H3 is being redirected.

If we take a look at the routing desk on R1, we’ll see nothing has modified.

R1#present ip route   

Routing entry for
  Recognized through "ospf 1", distance 110, metric 3, sort intra space
  Final replace from on GigabitEthernet0/3, 00:23:02 in the past
  Routing Descriptor Blocks:
  *, from, 00:23:02 in the past, through GigabitEthernet0/3
      Route metric is 3, visitors share depend is 1

There are a number of helpful instructions on the router to test the standing of coverage based mostly routing.

First up, a primary “present” command price noting.

R1#present route-map 

route-map POLICY-BASED-ROUTING, allow, sequence 10
  Match clauses:
    ip tackle (access-lists): H1-to-H3 
  Set clauses:
    ip next-hop
  Coverage routing matches: 12 packets, 756 bytes

This command offers “coverage match” statistics. We are able to see that once I ran this command there have been 12 matches to this point.

One other command that’s helpful is the “debug ip coverage” command. It offers helpful particulars concerning the processing of the coverage as visitors flows by the router. However as with all “debug” command, watch out utilizing it on a manufacturing machine as it might put a heavy load on community units if there’s quite a lot of visitors flowing by.

I’ll activate the debugging after which ship a single ICMP (ping) packet from H1 -> H3.

R1#debug ip coverage
Coverage routing debugging is on

*Apr 26 00:29:58.282: IP: s= (GigabitEthernet0/1.100), d=, len 84, FIB coverage match
*Apr 26 00:29:58.282: IP: s= (GigabitEthernet0/1.100), d=, len 84, PBR Counted
*Apr 26 00:29:58.282: IP: s= (GigabitEthernet0/1.100), d=, g=, len 84, FIB coverage routed

Examine the above output to the debug output once I ping H1 -> H4.

*Apr 26 00:31:00.294: IP: s= (GigabitEthernet0/1.100), d=, len 84, FIB coverage rejected(no match) - regular forwarding

Within the first instance, “FIB coverage match” signifies that the PRB coverage was triggered. And a following debug line reveals that the visitors was “FIB coverage routed.” That’s the PBR in motion. Examine that to the output from the second ping that’s “FIB coverage rejected (no match) – regular forwarding.” That output is fairly descriptive.

And with that, we’ve come to the top of this submit. I hope this brief take a look at coverage based mostly routing helped break it down and introduce you to a brand new expertise software which you could put into your toolkit. Perhaps it’ll make it easier to clear up a enterprise problem sometime. Or possibly it’ll make it easier to in your preparation for the ENARSI examination or different research. Both manner, thanks for hanging out with me right now.

 Acquired a subject you’d like me to breakdown? Let me know within the feedback.



Be a part of the Cisco Studying Community right now at no cost.

Observe Cisco Studying & Certifications

Twitter | Fb | LinkedIn | Instagram | YouTube

Use #CiscoCert to affix the dialog.


Related Posts

Are video video games unhealthy for teenagers? The reply is difficult : Pictures

I grew up within the Eighties and 90s, with dad and mom who strictly managed my “display screen time,” which just about solely meant TV again then, in addition to…

Read more

Need to Dwell Longer and More healthy? Peter Attia Has a Plan.

Trendy drugs has been a miracle for wholesome getting old. However what if we’re nonetheless fascinated with the topic of residing higher for longer all fallacious? That’s the premise…

Read more
Mark smiles mid-stride in front of a grove of trees.

New and Noteworthy: What I Learn This Week—Version 223

Analysis of the Week Keto beats the DASH weight-reduction plan for sort 2 diabetics and hypertension. After the Out of Africa dispersal, there have been giant selective pressures and developments…

Read more
insect allies

Scientists Warn GE Bugs May Be Simply Weaponized

Editor’s Notice: This text is a reprint. It was initially printed October 23, 2018. Genetic engineering (GE) is being utilized in myriad methods lately, regardless of the very fact we…

Read more
Logo for WebMD

After Tragedy of Stillbirth, She Set Out to Assist Others

Could 26, 2023 — Elizabeth O’Donnell came upon she was pregnant in June 2020. It was a shock, however she was very glad. She was by no means sick and…

Read more


Gary Grey’s liver was failing. However docs advised him he would possibly die ready for a liver transplant, due to a coverage change that deprived Kansans and other people from…

Read more

Leave a Reply

Your email address will not be published. Required fields are marked *