WEBVTT

1
00:00.000 --> 00:03.680
So for one scenario, as an example of using policy-based routing,

2
00:03.680 --> 00:09.280
let's go ahead and set up policy-based routing and let's use R7 as our target.

3
00:09.280 --> 00:13.090
And as far as what we want to accomplish, let's go ahead on R7 and specify that

4
00:13.090 --> 00:14.080
any traffic

5
00:14.080 --> 00:19.760
sourced from PC7. So PC7's address right here is 10.1.7.10.

6
00:19.760 --> 00:23.440
A traffic source from that specific IP address is destined to

7
00:24.240 --> 00:31.170
go ahead and use PC8's address. So PC8 is over here. It's at 192.168.1.10. Let
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:24.240 --> 00:31.170
go ahead and use PC8's address. So PC8 is over here. It's at 192.168.1.10. Let

8
00:31.170 --> 00:31.200
's

9
00:31.200 --> 00:36.880
specify that any traffic source from PC7 and going to PC number 8 instead of

10
00:36.880 --> 00:37.360
using the normal

11
00:37.360 --> 00:40.840
routing table, which would normally go this way based on what we looked at in

12
00:40.840 --> 00:41.680
the overview.

13
00:41.680 --> 00:47.080
Instead of doing that, we'll go ahead and set the next top over here to R8's 10

14
00:47.080 --> 00:48.640
.78.0.8 address

15
00:48.640 --> 00:52.520
on its serial 3/2. And before we talk about the configuration and begin the

16
00:52.520 --> 00:53.040
configuration,

17
00:53.040 --> 00:57.220
let's also verify in the lab environment that the path without policy-based

18
00:57.220 --> 00:57.680
routing

19
00:57.680 --> 01:05.120
to go from PC7 over here to PC8 is indeed going from R7 to R5 to R3 to R1 to 2
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:57.680 --> 01:05.120
to go from PC7 over here to PC8 is indeed going from R7 to R5 to R3 to R1 to 2

20
01:05.120 --> 01:06.480
to 4 and 6 and 8.

21
01:06.480 --> 01:09.680
So here in the lab environment, we had the trace that we did earlier. Let's go

22
01:09.680 --> 01:10.240
ahead and do that

23
01:10.240 --> 01:15.500
trace again. So the dash P capital P space 1 says please use ICMP. If we didn't

24
01:15.500 --> 01:16.080
do that,

25
01:16.080 --> 01:19.680
we could go ahead and simply leave off the protocol we want to use and we'd use

26
01:19.680 --> 01:20.640
UDP by default

27
01:20.640 --> 01:26.080
at layer 4 for the trace. So we'll do a trace to 1.821cstate1.10 and indeed the

28
01:26.080 --> 01:26.960
first top is

29
01:26.960 --> 01:33.700
R7 and then the next top is .5R5 and then R31246 and 8. Fantastic. Any
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:26.960 --> 01:33.700
R7 and then the next top is .5R5 and then R31246 and 8. Fantastic. Any

30
01:33.700 --> 01:34.960
ingredients for

31
01:34.960 --> 01:38.160
setting up policy-based routing are going to be an access control list so let's

32
01:38.160 --> 01:38.640
go ahead and create

33
01:38.640 --> 01:43.350
access control list identifying the traffic from PC7 to PC8. And for that, let

34
01:43.350 --> 01:44.000
's use access

35
01:44.000 --> 01:48.490
control list 107 because we need to specify the destination address as well.

36
01:48.490 --> 01:49.360
And the standard ACL

37
01:49.360 --> 01:53.240
will only let us point to the source IP address information. Then we'll need a

38
01:53.240 --> 01:53.760
route map.

39
01:53.760 --> 01:57.450
And in that route map, effectively we're going to say if traffic matches this

40
01:57.450 --> 01:58.800
access control list,

41
01:58.800 --> 02:04.560
then we're going to set the next top to 10.78.0.8. We also want to verify that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:58.800 --> 02:04.560
then we're going to set the next top to 10.78.0.8. We also want to verify that

42
02:04.560 --> 02:05.520
that interface

43
02:05.520 --> 02:08.440
exists on both sides that we can ping directly across just to make sure we have

44
02:08.440 --> 02:09.440
that connectivity.

45
02:09.440 --> 02:16.400
So 10.78.0.8 is the IP address right there. And then to make this work, we'd

46
02:16.400 --> 02:17.760
apply that policy

47
02:17.760 --> 02:22.120
to interface gig 0.0. And it's going to apply to any inbound traffic. So any in

48
02:22.120 --> 02:22.560
bound traffic

49
02:22.560 --> 02:26.450
will be compared against the route map that's matching on the access control

50
02:26.450 --> 02:27.360
list. And if there's

51
02:27.360 --> 02:31.280
a match, you'll set the next top to 10.78.0.8. All right, so with that in mind,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:27.360 --> 02:31.280
a match, you'll set the next top to 10.78.0.8. All right, so with that in mind,

52
02:31.280 --> 02:32.400
let's go ahead and

53
02:32.400 --> 02:37.030
let's configure and test policy-based routing right here on router 7. And here

54
02:37.030 --> 02:38.560
we go. So initially,

55
02:38.560 --> 02:45.460
our path is going all the way around the network from PC7 to R7 to R5, R3, etc.

56
02:45.460 --> 02:46.720
All the way down through

57
02:46.720 --> 02:50.320
our 6 down to R8 as shown right here. So let's go to the right router. We'll go

58
02:50.320 --> 02:51.600
to R7. I mean,

59
02:51.600 --> 02:55.210
before we start creating an access control list to match on the traffic that's

60
02:55.210 --> 02:55.600
going to be used

61
02:55.600 --> 02:58.920
for our policy-based routing, we also should make sure we're not overriding an

62
02:58.920 --> 02:59.760
existing access

63
02:59.760 --> 03:03.350
control list. Let's just show access lists in press center and sure enough no
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:59.760 --> 03:03.350
control list. Let's just show access lists in press center and sure enough no

64
03:03.350 --> 03:04.080
access control list,

65
03:04.080 --> 03:07.430
we're going to configure your mode. And let's make one. Let's create access

66
03:07.430 --> 03:09.120
lists 107. And we'll do

67
03:09.120 --> 03:12.700
a permit. And let's go ahead and permit the question is what protocols we want

68
03:12.700 --> 03:13.680
to permit. For this

69
03:13.680 --> 03:17.500
example, we're just focusing on IP addresses. So let's say permit IP, which

70
03:17.500 --> 03:19.040
includes any layer

71
03:19.040 --> 03:22.880
for protocols in the world of IP. And then for the source address, let's go

72
03:22.880 --> 03:23.600
ahead and use the

73
03:23.600 --> 03:31.830
host of PC7. And that host address is 10.1.7.10. So we'll put in 10.1.7.10
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:23.600 --> 03:31.830
host of PC7. And that host address is 10.1.7.10. So we'll put in 10.1.7.10

74
03:31.830 --> 03:32.880
space. And for the destination

75
03:32.880 --> 03:37.840
we want to host and let's look at PC8's address real quick. It's address is 122

76
03:37.840 --> 03:39.920
.1.10. And we'll put that

77
03:39.920 --> 03:45.120
in 192.168.1.10. Fantastic press center. And now we have our access control

78
03:45.120 --> 03:46.720
list. So let's do show

79
03:46.720 --> 03:50.890
access lists. And there it is. Next, let's create a route map and include that

80
03:50.890 --> 03:52.160
access control list

81
03:52.160 --> 03:54.910
as one of the conditions for that route map. So to create a route map, please

82
03:54.910 --> 03:56.160
the command route map

83
03:56.160 --> 04:06.880
space, question mark. And then let's go ahead and call this pbr-from-PC7-2-PC8
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:56.160 --> 04:06.880
space, question mark. And then let's go ahead and call this pbr-from-PC7-2-PC8

84
04:06.880 --> 04:09.120
in press center. And when

85
04:09.120 --> 04:12.830
I apply this to the interface gig 0 0 on our 7-hulls copy paste that. So I don

86
04:12.830 --> 04:14.160
't have a typo there.

87
04:14.160 --> 04:17.830
And as part of this route map, we're then going to go ahead and do a match. So

88
04:17.830 --> 04:18.720
let's say match

89
04:18.720 --> 04:23.220
IP address. As far as the address we're matching on, it's going to be access

90
04:23.220 --> 04:24.320
list 107. So I'll go ahead and

91
04:24.320 --> 04:28.990
copy and paste that. And then furthermore, if traffic does match IP address 107

92
04:28.990 --> 04:30.240
, meaning source
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
04:28.990 --> 04:30.240
, meaning source

93
04:30.240 --> 04:37.010
from 10.1.7.10, going to 192.168.1.10, then we want to go and set the IP next

94
04:37.010 --> 04:38.000
hop. And let's take

95
04:38.000 --> 04:43.880
a look at our topology real quick. We want the next hop to be 10780.8. And that

96
04:43.880 --> 04:45.360
's the IP address on

97
04:45.360 --> 04:52.770
our 8's serial 3-2. So set IP next hop to 10.78.0.8. And let's type in exit and

98
04:52.770 --> 04:54.160
let's take a look at our work.

99
04:54.160 --> 05:00.330
Let's do a do show route map. And it is matching on access list 107. Fantastic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
04:54.160 --> 05:00.330
Let's do a do show route map. And it is matching on access list 107. Fantastic.

100
05:00.330 --> 05:01.200
It can evit seize that.

101
05:01.200 --> 05:05.460
If there's match, it's going to set the next hop to 10.78.0.8. Also while we're

102
05:05.460 --> 05:05.920
here, this is

103
05:05.920 --> 05:12.700
verifying we can ping that with a do ping to 10.78.0.8. And sure enough, let's

104
05:12.700 --> 05:15.840
also do a trace over to 10.78.0.8.

105
05:15.840 --> 05:18.820
Just to make sure it's a direct connection. And it is. So our next step is to

106
05:18.820 --> 05:20.240
go ahead and apply that

107
05:20.240 --> 05:26.190
policy to gig 00. So any inbound traffic coming in on gig 00 here on our 7. We

108
05:26.190 --> 05:26.720
'll be considered

109
05:26.720 --> 05:30.750
against the policy. And if there's a match, it'll set the next hop to our 8's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
05:26.720 --> 05:30.750
against the policy. And if there's a match, it'll set the next hop to our 8's

110
05:30.750 --> 05:31.600
address. And as a

111
05:31.600 --> 05:35.090
result, it should forward the traffic directly over to our 8 over at the serial

112
05:35.090 --> 05:35.920
link instead of

113
05:35.920 --> 05:39.020
forwarding it up to our 5 based on the normal routing table. So we're going to

114
05:39.020 --> 05:40.400
interface gig 00

115
05:40.400 --> 05:45.640
here on our 7. And we'll use the syntax IP policy route map space. And then we

116
05:45.640 --> 05:46.240
're going to go ahead

117
05:46.240 --> 05:49.490
and copy and paste that route map name, which is right here because it's super

118
05:49.490 --> 05:50.160
long. We don't

119
05:50.160 --> 05:52.860
want to have a typo. So I'm going to copy it from here. And I'm going to right

120
05:52.860 --> 05:53.680
click to paste it

121
05:53.680 --> 05:57.730
in and a space. And that's it. Now there's not an option of in or out because

122
05:57.730 --> 05:58.720
this only applies

123
05:58.720 --> 06:03.220
to ingress or inbound traffic here on gig 00. So press enter and then we'll
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:58.720 --> 06:03.220
to ingress or inbound traffic here on gig 00. So press enter and then we'll

124
06:03.220 --> 06:04.800
type in end. And let's do

125
06:04.800 --> 06:08.540
a few verification checks. Let's do a show access list. Just to make sure our

126
06:08.540 --> 06:09.520
access list is correct.

127
06:09.520 --> 06:15.890
1017 10 going to 192 168 1.10. Those are the addresses of PC 7 and PC 8

128
06:15.890 --> 06:17.920
respectively. Fantastic.

129
06:17.920 --> 06:21.490
Next to a show route map, just to verify our route map. So we're matching on

130
06:21.490 --> 06:21.920
access

131
06:21.920 --> 06:27.050
to 107. And if that happens, we then I guess at the next top to 1078 0.8. Then

132
06:27.050 --> 06:27.840
we can do a show IP

133
06:27.840 --> 06:31.900
policy and press center. It will confirm for us the route map that we have
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
06:27.840 --> 06:31.900
policy and press center. It will confirm for us the route map that we have

134
06:31.900 --> 06:33.200
associated for our policy

135
06:33.200 --> 06:37.110
based routing and which interface it's applied to, which in this case is gig 00

136
06:37.110 --> 06:38.880
. We also do a show run

137
06:38.880 --> 06:43.140
for interface gig 00. There'd be another way of verifying this there. And there

138
06:43.140 --> 06:44.080
it is right there.

139
06:44.080 --> 06:51.330
So now we go to PC 7. And we look at that trace we did to 192 168 1.10. Now

140
06:51.330 --> 06:52.480
that we have done that

141
06:52.480 --> 06:56.690
policy on our 7. If we hit the upper key into the same exact trace again,

142
06:56.690 --> 06:58.160
notice now it's not saying

143
06:58.160 --> 07:03.910
it up to our 5 and then our 3 and our 1 etc. In this case, it's going directly
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
06:58.160 --> 07:03.910
it up to our 5 and then our 3 and our 1 etc. In this case, it's going directly

144
07:03.910 --> 07:05.600
from the router or 7.

145
07:05.600 --> 07:11.300
It's at .7. And the next top is 107 8 0.8. And we have this destination port un

146
07:11.300 --> 07:12.000
reachable message.

147
07:12.000 --> 07:15.910
And I'm going to hit the upper key and do a dash capital P. And let's do a one

148
07:15.910 --> 07:17.520
for ICMP instead of UDP.

149
07:17.520 --> 07:21.280
And that way the final destination won't complain that it doesn't have some UDP

150
07:21.280 --> 07:21.760
open port

151
07:21.760 --> 07:25.560
listing and waiting. But the path is indeed the same. Now another really cool

152
07:25.560 --> 07:26.640
thing that we can do

153
07:26.640 --> 07:31.020
is we can go back to our 7. And we can actually do a debug to verify that what
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
07:26.640 --> 07:31.020
is we can go back to our 7. And we can actually do a debug to verify that what

154
07:31.020 --> 07:32.000
we think is happening

155
07:32.000 --> 07:37.120
is indeed happening. And we can do that with a debug IP policy just like that

156
07:37.120 --> 07:38.400
press enter. So any

157
07:38.400 --> 07:43.520
traffic that matches the route map and is policy based routed will be indicated

158
07:43.520 --> 07:44.560
by having a match

159
07:44.560 --> 07:48.850
here in the debug. And a traffic that doesn't match that flow of traffic is

160
07:48.850 --> 07:49.680
going to go ahead and

161
07:49.680 --> 07:55.330
simply be routed as normal. So let's do examples of both. Let's go back to PC 7

162
07:55.330 --> 07:56.480
. And on PC 7,

163
07:56.480 --> 08:03.090
let's do a quick ping over to 192.1cg8.1.10. So this traffic should match
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

163
07:56.480 --> 08:03.090
let's do a quick ping over to 192.1cg8.1.10. So this traffic should match

164
08:03.090 --> 08:04.400
because it's coming from PC 7's

165
08:04.400 --> 08:09.900
dress going to PC 8's dress. And we have the pings are working no problem. But

166
08:09.900 --> 08:11.200
if you go back to our 7,

167
08:11.200 --> 08:15.170
it's going to show us the debug. Check this out. Here showing us the source 10

168
08:15.170 --> 08:17.120
1710, the destination

169
08:17.120 --> 08:22.220
192.1cg81.10. And it shows that there was a policy match. And as a result, it

170
08:22.220 --> 08:23.600
was policy based routed.

171
08:23.600 --> 08:28.070
Now if we go back to PC 7 and let's ping something else in the network, let's

172
08:28.070 --> 08:28.880
go back to our topology.

173
08:28.880 --> 08:32.590
Let's ping. How about the loop back on R8, which is, in fact, let's do a loop
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

173
08:28.880 --> 08:32.590
Let's ping. How about the loop back on R8, which is, in fact, let's do a loop

174
08:32.590 --> 08:34.720
back on R6, which is 6666.

175
08:34.720 --> 08:39.280
So if we do a ping there, that traffic because it's coming from PC 7 but not

176
08:39.280 --> 08:40.560
destined to the IP dress

177
08:40.560 --> 08:45.780
to PC 8, that should not match our policy based routing. So from PC 7, if we do

178
08:45.780 --> 08:48.160
a ping to 6.6.6.6,

179
08:48.160 --> 08:51.660
that traffic because it doesn't match the PBR or the policy based routing, it

180
08:51.660 --> 08:52.160
should be routed

181
08:52.160 --> 08:56.400
normally. And we can also verify that with a trace up to that address 6666,

182
08:56.400 --> 08:57.680
press center. And that

183
08:57.680 --> 09:02.800
path is going through the R7 router, then R5, then R3, then 1, 2, 4, and 6. We
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
08:57.680 --> 09:02.800
path is going through the R7 router, then R5, then R3, then 1, 2, 4, and 6. We

184
09:02.800 --> 09:04.240
can also attach capital P

185
09:04.240 --> 09:09.030
space 1 to use ICMP instead. And we'll notice that we have the same path. We

186
09:09.030 --> 09:09.840
thought the error about

187
09:09.840 --> 09:14.720
the destination port for UDP being unreachable at the end. And as here says,

188
09:14.720 --> 09:16.000
fib policy rejected no

189
09:16.000 --> 09:19.750
match is something doing normal forwarding based on the IPV for routing table,

190
09:19.750 --> 09:20.720
which we can see with

191
09:20.720 --> 09:25.740
show IP route. So if we go back to PC 7 to a trace to 1.0.1.6.8.1.10, it's

192
09:25.740 --> 09:27.200
going to take the policy based

193
09:27.200 --> 09:30.910
routed path. In fact, this is to a trace there instead, just to verify that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

193
09:27.200 --> 09:30.910
routed path. In fact, this is to a trace there instead, just to verify that

194
09:30.910 --> 09:32.000
little trace to that

195
09:32.000 --> 09:36.420
destination. That's PC 8's address. We'll do a dash capital P protocol 1. And

196
09:36.420 --> 09:37.440
that's taking the

197
09:37.440 --> 09:41.770
direct path due to the policy based routing. And if we do a trace to some of

198
09:41.770 --> 09:43.040
the address, for example,

199
09:43.040 --> 09:46.780
let's go to 100, which is another server. In fact, let me show you that real

200
09:46.780 --> 09:49.040
quick. That is server 1.0.8.

201
09:49.040 --> 09:52.630
Sitting on that same subnet because it is not the destination of .10. It's not

202
09:52.630 --> 09:53.280
going to be policy

203
09:53.280 --> 09:57.230
based routed. It should take the long way around, which indeed it is from R7 to

204
09:57.230 --> 09:58.960
R5, R3, R1, R2,

205
09:58.960 --> 10:04.360
or 4, or 6, and R8. Now in preparation for the next video, I'm going to go back
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

205
09:58.960 --> 10:04.360
or 4, or 6, and R8. Now in preparation for the next video, I'm going to go back

206
10:04.360 --> 10:05.120
to R7,

207
10:06.720 --> 10:11.730
and in R7 we'll do an undibug all. Let's do a show run for interface gig 00.

208
10:11.730 --> 10:12.400
And I'm going to take off

209
10:12.400 --> 10:16.090
that policy. So we're going to configure ACEM mode. We'll go to interface gig

210
10:16.090 --> 10:17.280
00. Let's copy paste

211
10:17.280 --> 10:21.550
that to make it faster. And we'll say no. And then we'll go to IP policy route

212
10:21.550 --> 10:22.640
map to take it off

213
10:22.640 --> 10:26.680
and apply that. So now if we go back to PC 7, a moment ago, when we were at

214
10:26.680 --> 10:27.760
trace to .10,

215
10:27.760 --> 10:31.660
it was going through the policy based routed path. But now that we removed that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

215
10:27.760 --> 10:31.660
it was going through the policy based routed path. But now that we removed that

216
10:31.660 --> 10:32.560
from the interface

217
10:32.560 --> 10:36.380
on R7, if we press enter now, we're taking the normal path based on the normal

218
10:36.380 --> 10:37.440
routing table.

219
10:37.440 --> 10:40.400
And in the next video, you and I get to take a look at implementing policy

220
10:40.400 --> 10:41.040
based routing,

221
10:41.040 --> 10:45.050
but this time leveraging the layer for protocol that's in use as well. So I'll

222
10:45.050 --> 10:45.520
see you in the next

223
10:45.520 --> 10:47.120
video in just a moment.