Traffic routing with Policy-based routing (PBR)
Packet routing is generally carried out by equipment by consulting its routing table where they look for the best routes based on their destination address.
However, what I intend to show is that there are other forms of packet routing, such as PBR, which allows routes to be changed based on other criteria such as source addresses, packet size or next hop.
To show one of the ways to configure packet forwarding based on PBR, I will use an example:
In the company we have two departments that have different access to the Internet due to the needs of the IT Team who need better access to the Internet. What we are going to show is a way to configure the routing of each network for its Internet access, and both teams access the DMZ and can also communicate with each other.
The first step will be to carefully configure an ACL to select only the traffic we want to redirect. As we want to redirect all traffic destined for the Internet, we make the following configuration:
ACL name IT_TEAM number 3001 rule 10 permit ip source 192.168.0.0 0.0.0.255 destination any rule 15 permit ip source 192.168.1.0 0.0.0.255 destination any # ACL Name COM_TEAM number 3002 rule 10 permit ip source 192.168.2.0 0.0.0.255 destination any rule 15 permit ip source 192.168.3.0 0.0.0.255 destination any |
After defining the ACLs, they configured the traffic classifiers
traffic classifier TC_IT_TEAM type or if-match acl 3001 # traffic classifier TC_COM_TEAM type or if-match acl 3002 |
The next step was to choose what to do with the traffic they had just categorized.
traffic behavior TB_IT_TEAM redirect nexthop 192.168.0.147 # traffic behavior TB_COM_TEAM redirect nexthop 192.168.0.149 |
As you know after the classifier and traffic behavior are configured they need to be put together to make sense. And that's what they did too.
traffic policy TP_IT_TEAM classifier TC_IT_TEAM behavior TB_IT_TEAM # traffic policy TP_COM_TEAM classifier TC_COM_TEAM behavior TB_COM_TEAM |
Finally, the traffic policies were configured. The only thing left to do was to apply the traffic policies on the switch.
traffic-policy TP_IT_TEAM global inbound # traffic-policy TP_COM_TEAM global inbound |
After that, traffic destined for the internet was redirected according to the policy.
