- [instructor] Now that we've talked about the theory,
of policy based routing or PBR,
let's set it up.
Take a look at this typology on screen.
We've got a PC that wants to get down to the server.
And there are two ways it could get there.
It's going to go to a default gateway,
which is R1,
then we have a choice to make,
are we going to go to a next top of BB2 or BB1
and then down to the server?
Well, I'm running OSPF as the routing protocol between R1
and BB1 and BB2,
and yes I have changed the reference bandwidth,
so that OSPF can tell the difference between,
the 100 meg link and the gig link.
Remember by default, it considers both of those
to have a cost of one,
but I adjusted the reference band with,
so it really does prefer the gig link.
And that's the path we're going to be taking.
We're going to go from the PC to R1,
and it's going to say the cost is less,
if I go to BB2 and then out to the server.
But let's say for some reason, for some security reason,
a performance reason, or for some design reason,
we want traffic from that PC to go through BB1
to the server, not BB2.
We can override the routing protocol instruction,
by using a policy based routing.
Before we configure that on our R1,
let's confirm that we really are going through BB2.
Let's do a trace route to the server at 198.51.100.3.
And notice that our first hop is no surprise R1.
By the way this PC, it is a router,
but I don't have a routing protocol running on it.
It's configured with a default gateway,
so it's acting as just a host right now.
And it goes to a next top of R1.
Notice the next top though, this is the big one,
203.0.113.5.
If you look at the topology, the .5 tells us
we're going to BB2 as the next top.
If that had been .1,
that would have been BB1 as the next top.
We want to influence the traffic to start using BB1,
but right now we've just confirmed that it's using BB2,
and then in regard to the server,
and that's this IP address down at the bottom.
Let's go over to R1 and do our configuration.
And we're going to begin by matching traffic,
going from the PC down to the server.
We're going to do that with an access control list.
Remembering that an access control list or an ACL,
can not just say, permit this packet or drop that packet,
it can actually be used to match traffic.
So when we say permit, we're meaning match.
We're going to use an ACL and it's matching capacity here.
Let's go into R1,
and I'll say access-list,
and I'll use an extended access list of 100.
And I want to permit all IP traffic coming from a host
of 192.0.2.2, that's the PC,
going to a host of 198.51.100.3, that's the server.
Now, we want to create a route map, and this route map
is going to reference this access control list.
And we can say with a route map,
if you match this VIN set this parameter,
and I'm going to say, if we match this access control list,
then I'm going to set the next hop IP address to BB1,
then we'll apply that as a policy.
So, let's create a route map.
We'll say route-map,
and I'll call it PC-TO-SERVER,
and I want to match IP traffic that matches
the access control list of 100.
And if I do have a match,
then I want to set the ip next-hop IP address to 203.0.113.1,
that's BB1.
Now, we want to take that route map and apply it
to the incoming interface as a policy.
Remember that PBR works on the ingress interface,
so we're going to apply this to Gigabit0/1.
By the way, when I created this route map notice
I did not give a number here right after the statement,
But sometimes you see a route map
that has a number at the end
like 10 or 20 or 30,
that's when we have multiple route map statements,
and that number is the sequence number
that dictates the order.
The reason I didn't do that here is I've only got one.
I've only got one match set pair.
I'm not trying to match anything else.
So there was no need for a sequence number,
but we could have certainly typed in a 10
if we had wanted to.
Now, let's go into the ingress interface.
I'll say interface Gigabit0/1,
and let's apply our policy.
Let's say, ip policy route-map
and the route map name was PC-TO-SERVER.
And we're done.
Now, let's go back to the PC
and see if it's truly obeying these new rules.
If I go back to the PC... remember before
when we did the trace route,
R1 went to BB2 this .5.
Hopefully, if everything works correctly,
we're now going to go from R1 to BB1.
So instead of a .5, that should be a .1.
So let's do another trace route and see what we get.
Look at this.
We go to R1, then we go to 203.0.113.1.
That confirms that we're going to BB1
on our way down to the server.
That's policy-based routing.
And policy-based routing by itself,
is based on traffic coming into a router.
And in our previous video,
we talked a little bit about something called local PBR,
because policy-based routing by itself,
applies to the ingress interface,
it applies to traffic coming into a router.
What about traffic originating from the router?
Well, that's not going to be controlled
with policy-based routing.
However, we could set up local PBR and that can control it.
In fact, let's go to router R1
and let's generate some traffic from R1.
I'm going to do a trace route to the server,
and I'm going to do it from a source of R1's
interface Gigabit0/3 .
In other words, the source is going to be 203.0.113.6.
And let's do a trace route to a destination IP address
of 198.51.100.3,
coming from a source of 203.0.113.6.
So, I'm guessing that traffic coming from the router
is going to go from gig0/3 out of gig0/3
down to BB2, down to the server.
Let's press Enter and see what happens.
No surprise here.
We go to our next top of BB2, notice the .5,
and then we go out to the server.
Well, let's set up local PBR,
such that we're going to go to BB1 as our next top.
We're going to set it up very similarly
to what we did before,
but we're going to apply it globally to the router
instead of to an interface.
Let's go to global configuration mode
and set up a different access list.
I'll say access-list 101,
and I want to permit which means match in this context.
I want to permit traffic,
all IP traffic coming from a host
of 203.0.113.6,
going to a host of 198.51.100.3.
And let's create a route map
that's going to match that traffic or create a route map,
that's going to be called, R1-TO-SERVER,
and I want to match traffic defined by the ACL 101.
And if we do have a match,
I want to set the ip next-hop IP address
to 203.0.113.1, that's BB1,
and now let's apply globally to the router.
Here's how we set up local PBR.
We say ip local-policy route-map
R1-TO-SERVER.
I should not have put a hyphen right there,
it's just local space policies.
Let's fix that.
And we're done.
Let's do that trace route again.
This time, even though I'm sourcing my IP address
from Gigabit0/3,
it would seem like a no brainer that we would go
out of Gigabit0/3 to BB2 down to the server.
But, this policy is going to override that behavior.
Hopefully our next top is going to be BB1.
Let's try it.
Now look at this.
We're going to 203.0.113.1.
So we've overwritten traffic originating on the local router
to use an alternate path alternate to what
the IP routing table would have us do.
And that's a look at PBR and local PBR.