Administrator Guide

748 Access Control Lists
5 Configure Policy Routing. To policy-route such traffic to VLAN routing
interface 30, the following additional steps should be performed:
a Create an access-list matching all incoming IP traffic from host 1.1.1.1
destined to host 2.2.2.2:
console(config)#ip access-list Match-ip-1_1_1_2-to-2_2_2_2
console(config-ip-acl)#permit ip host 1.1.1.2 host 2.2.2.2
console(config-ip-acl)#exit
There is no need to add a permit every rule, as would be configured in
a normal access list, as this ACL will only be used for PBR. The default
for PBR is to route non-matching traffic or traffic which is addressed
to a non-connected interface normally.
b Create a route-map and add match/set rules to the route-map:
console(config)#route-map Redirect_to_3_3_3_3 permit 100
console(route-map)#match ip address Match-ip-1_1_1_2-to-
2_2_2_2
console(route-map)#set ip next-hop 3.3.3.3
console(route-map)#exit
c Assign the route-map to VLAN routing interface 10:
console(config)#interface vlan 10
console(config-if-vlan10)#ip policy route-map
Redirect_to_3_3_3_3
console(config-if-vlan10)#exit
Traffic matching ACL Match-ip-1_1_1_2-to-2_2_2_2 is now policy-routed to
VLAN interface 30 when an interface in VLAN 30 is connected via policy
Redirect_to_3_3_3_3. Counters are incremented in the show route-map
command indicating that traffic is being policy routed.
console(config)#show route-map Redirect_to_3_3_3_3
route-map “Redirect_to_3_3_3_3” permit 10
Match clauses:
ip address (access-lists) : match-subnet-1_1_1_X
Set clauses:
ip next-hop 3.3.3.3
Policy routing matches: 19922869 packets, 1275063872 bytes