Users Guide

● Create an ACL and define what should be enabled for PBR processing.
ip access-list TEST-ACL
seq 10 permit tcp any any eq 80
seq 20 permit tcp any any eq 443
seq 30 permit tcp any any eq 21
seq 40 permit icmp any any
● Create an ACL and define what should be excluded from PBR processing.
ip access-list TEST-ACL-DENY
seq 10 permit tcp 10.99.0.0/16 10.0.0.0/8 eq 80
seq 20 permit tcp 10.99.0.0/16 10.0.0.0/8 eq 443
seq 30 permit tcp 10.99.0.0/16 10.0.0.0/8 eq 21
seq 40 permit icmp 10.99.0.0/16 10.0.0.0/8
● Create a route-map to block specific traffic from PBR processing.
route-map TEST-RM deny 5
match ip address TEST-ACL-DENY
● Create a route-map to permit traffic for PBR processing.
route-map TEST-RM permit 10
match ip address TEST-ACL
set ip next-hop 10.0.40.235
● Apply the policy to the previously created interface.
ip policy route-map TEST-RM
NOTE:
In PBR, the permit or deny action specified in the access list does not determine whether the traffic is forwarded
or dropped. The permit or deny action specified in the route-map configuration determines the results of PBR
processing.
In this configuration, the route-map TEST-RM deny 5 configuration blocks traffic that matches the TEST-ACL-DENY ACL
from further PBR processing. This traffic is routed using the routing table. The route-map TEST-RM permit 10
configuration sends traffic that matches the TEST-ACL ACL for PBR processing. Any packet that matches the TEST-ACL ACL
is forwarded to 10.0.40.235.
View PBR configuration
Use the show configuration command to view the configuration of the interface.
OS10(conf-if-vl-40)# show configuration
!
interface vlan40
no shutdown
ip policy route-map test
Use the show route-map command to view the route-map configuration.
OS10(config)# do show route-map
route-map map1, permit, sequence 10
Match clauses:
ipv6 address (access-lists): acl1
Set clauses:
ipv6 vrf {vrf-name} next-hop 5555::5556
OS10(conf-if-vl-40)# do show route-map
route-map test, permit, sequence 10
Match clauses:
ip address (access-lists): acl1
Set clauses:
ip next-hop 1.1.1.1 track-id 200
OS10(conf-if-vl-40)# do show route-map test
Layer 3
809