WEBVTT

1
00:00.000 --> 00:03.420
In this video, I'd love to walk you through an example of once again using PBR,

2
00:03.420 --> 00:04.320
but this time,

3
00:04.320 --> 00:08.320
let's go ahead and use a couple different sequences instead of a route map.

4
00:08.320 --> 00:13.520
And so let's focus on traffic that's coming from this PC and this server. This

5
00:13.520 --> 00:14.480
one's at .10

6
00:14.480 --> 00:20.370
and this one's at .100. And this focus also on the target of 7777, which is the

7
00:20.370 --> 00:21.040
loop back address

8
00:21.040 --> 00:25.450
right here on R7. So by default, the traffic should go up to R6 and all the way

9
00:25.450 --> 00:26.800
around the horn

10
00:26.800 --> 00:30.960
until it goes down on the left hand side down to R7 based on the routing tables
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:26.800 --> 00:30.960
until it goes down on the left hand side down to R7 based on the routing tables

11
00:30.960 --> 00:31.600
on the individual

12
00:31.600 --> 00:34.130
routers. And to make part of that is because these links right here are not

13
00:34.130 --> 00:35.360
included in OSPF.

14
00:35.360 --> 00:40.160
Now as a result, the routes to the 777 address are not reachable over the 1070

15
00:40.160 --> 00:41.280
network because

16
00:41.280 --> 00:44.980
these serial interfaces here are not in OSPF. So on R8, because we do have

17
00:44.980 --> 00:46.320
multiple potential paths

18
00:46.320 --> 00:49.440
to use, we have the path going up to R6, we have the path that goes up to R3,

19
00:49.440 --> 00:50.240
and also a path that

20
00:50.240 --> 00:54.590
goes over to R7, let's set up policy based running again, but this time we'll

21
00:54.590 --> 00:55.360
do it based on

22
00:55.360 --> 00:59.680
traffic coming from PC10, taking one path, traffic from server one, going

23
00:59.680 --> 01:00.960
through another path,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.680 --> 01:00.960
through another path,

24
01:00.960 --> 01:03.970
and then traffic that does match either of those, going through the normal

25
01:03.970 --> 01:04.880
routing tables.

26
01:04.880 --> 01:07.730
So if the access control is going to make two entries, one that matches on

27
01:07.730 --> 01:08.240
traffic,

28
01:08.240 --> 01:14.630
source from PC8, and another entry for traffic sourced from server one, and PC8

29
01:14.630 --> 01:15.840
is over at .10 and

30
01:15.840 --> 01:20.000
server one's down here at .100. And for the protocol that's match on ICMP and

31
01:20.000 --> 01:21.120
for the destination,

32
01:21.120 --> 01:26.490
it'll be the loop packet rest of R7, which is 7.7.7.7. And then we'll create a

33
01:26.490 --> 01:27.360
route map with two

34
01:27.360 --> 01:32.200
sequences, let's use sequence 10, matching on the first ACL for PC8's traffic,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:27.360 --> 01:32.200
sequences, let's use sequence 10, matching on the first ACL for PC8's traffic,

35
01:32.200 --> 01:32.640
then we'll make

36
01:32.640 --> 01:36.720
another sequence of 20, and we'll match on the ACL that matches on the server

37
01:36.720 --> 01:37.600
one traffic.

38
01:37.600 --> 01:41.880
And for the first sequence of our route map, for sequence 10, if traffic

39
01:41.880 --> 01:43.040
matches PC8's sourced

40
01:43.040 --> 01:49.340
rest, going to 7.7.7 using ICMP, let's go ahead and set the next top to 10380.3

41
01:49.340 --> 01:50.320
, which would pour the

42
01:50.320 --> 01:56.590
traffic this way. So we'll say next top is 10.38.0.3. And for other traffic,

43
01:56.590 --> 01:57.360
that doesn't match the first

44
01:57.360 --> 02:00.610
sequence number here, but does match sequence 20, which is matching on the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:57.360 --> 02:00.610
sequence number here, but does match sequence 20, which is matching on the

45
02:00.610 --> 02:02.320
traffic coming from server one,

46
02:02.320 --> 02:07.630
going to that IP address using ICMP. Let's go ahead and set the next top to 10.

47
02:07.630 --> 02:09.440
780.7. And let me go

48
02:09.440 --> 02:14.210
ahead and color code those as well. So traffic from PC8 would go here, here,

49
02:14.210 --> 02:16.240
and then down. And for

50
02:16.240 --> 02:20.870
traffic coming in on GIG-00 coming in from the server, that traffic would go

51
02:20.870 --> 02:23.440
like that straight across.

52
02:23.440 --> 02:27.770
And for traffic that didn't match either of these two entries in our route maps

53
02:27.770 --> 02:28.480
, that traffic

54
02:28.480 --> 02:33.060
would just be routed as normal, going up to R6, then R4, etc. So with that in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
02:28.480 --> 02:33.060
would just be routed as normal, going up to R6, then R4, etc. So with that in

55
02:33.060 --> 02:34.080
mind, let's go to our

56
02:34.080 --> 02:37.490
lab environment and let's lab this up and test it out. So back in the lab

57
02:37.490 --> 02:38.960
environment here, once again,

58
02:38.960 --> 02:42.320
is our topology. Great, great, great. So let's begin our configuration right

59
02:42.320 --> 02:44.320
here on R8 by creating some

60
02:44.320 --> 02:47.280
access control lists. So we'll go to the right router. So we'll go to the R8

61
02:47.280 --> 02:48.960
tab. And here on R8,

62
02:48.960 --> 02:52.550
let's do a quick show, access lists, just to see what we currently have.

63
02:52.550 --> 02:53.760
Currently, we don't have any,

64
02:53.760 --> 02:56.830
so we'll go ahead and create somebody going into configuration mode. And let's

65
02:56.830 --> 02:58.160
create access list

66
02:58.160 --> 03:03.980
101. And we'll permit ICMP traffic, fit source from host. Let's go ahead and do
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:58.160 --> 03:03.980
101. And we'll permit ICMP traffic, fit source from host. Let's go ahead and do

67
03:03.980 --> 03:07.360
PC8 at 192.168.1.10.

68
03:07.360 --> 03:11.540
Just confirm that address in our topology real quick. So PC8's address is 192.

69
03:11.540 --> 03:13.760
168.1.10. Fantastic.

70
03:13.760 --> 03:19.460
And the destination is going to be the 32-degree of 7.7.7.7. Just like that.

71
03:19.460 --> 03:20.080
And let's create another

72
03:20.080 --> 03:24.410
access control list. We'll make access list 102. That will match on the source

73
03:24.410 --> 03:26.080
address of server 1,

74
03:26.080 --> 03:30.560
which is at .100. And using ICMP going to the same destination address. So
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
03:26.080 --> 03:30.560
which is at .100. And using ICMP going to the same destination address. So

75
03:30.560 --> 03:31.360
since we're sitting

76
03:31.360 --> 03:34.650
right here, this is server 1 that we're currently sitting at with the multi-tab

77
03:34.650 --> 03:35.760
buddy. Let's first

78
03:35.760 --> 03:39.310
be before we actually implement the policy. Let's go to a command prompt here

79
03:39.310 --> 03:40.640
on server 1. Let's do an

80
03:40.640 --> 03:45.380
IP config just to confirm our address. So here's the lab network interface card

81
03:45.380 --> 03:46.480
. And its address is

82
03:46.480 --> 03:53.660
192.168.1.100. And let's do a quick trace with TRAC-ERT, which is how you spell

83
03:53.660 --> 03:54.960
it on a Windows computer.

84
03:54.960 --> 04:00.170
We'll do a -D for don't bother doing name resolution to 7.7.7.7. And there is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:54.960 --> 04:00.170
We'll do a -D for don't bother doing name resolution to 7.7.7.7. And there is

85
04:00.170 --> 04:01.040
our path through the

86
04:01.040 --> 04:06.800
network going through our 8, then our 6, then our 4, our 2, our 1, our 3, our 5

87
04:06.800 --> 04:08.400
finally gets to our 7.

88
04:08.400 --> 04:14.000
Let's also test the path going from PC8. So there's a tab here for PC8 right

89
04:14.000 --> 04:15.600
there. So we've got a PC8

90
04:15.600 --> 04:21.910
and we do a trace to 7.7.7.7 and press enter. That should show us the same path

91
04:21.910 --> 04:22.240
with the first

92
04:22.240 --> 04:25.230
top being our 8. And we have the destination port in reachable because by

93
04:25.230 --> 04:27.280
default it's using UDP. So

94
04:27.280 --> 04:31.680
if we hit the up arrow key and do a -capital P space 1 that will use protocol
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
04:27.280 --> 04:31.680
if we hit the up arrow key and do a -capital P space 1 that will use protocol

95
04:31.680 --> 04:32.560
number 1 which is

96
04:32.560 --> 04:36.690
ICMP and that will avoid that destination port in reachable on the last top.

97
04:36.690 --> 04:37.520
But the path is from

98
04:37.520 --> 04:42.760
our 8, our 6, our 4, our 2, our 1, our 3, our 5 until it hits our 7. So let's

99
04:42.760 --> 04:44.240
go to router 8 and

100
04:44.240 --> 04:48.650
let's continue setting up our policy. So the next step would be to create a

101
04:48.650 --> 04:49.600
route map. So we'll

102
04:49.600 --> 04:52.920
type in route map. And I'm just going to call this one PBR and let's do a

103
04:52.920 --> 04:53.840
permit and let's use

104
04:53.840 --> 04:59.170
sequence 10 and then in this sequence number let's match an IP address 101 and

105
04:59.170 --> 05:00.160
if that's true we'll
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
04:59.170 --> 05:00.160
if that's true we'll

106
05:00.160 --> 05:04.370
set the IP next top and let's take a look at our topology. We want the next top

107
05:04.370 --> 05:05.040
for that traffic

108
05:05.040 --> 05:11.710
coming from PC8 to be our 3's 0, 3-2 address which is 1038.0.3. So we'll put

109
05:11.710 --> 05:12.720
that in as the next

110
05:12.720 --> 05:17.820
top 10.38.0.3 and that looks great with IP exit. And then we'll do one more

111
05:17.820 --> 05:18.800
sequence number,

112
05:18.800 --> 05:22.490
we'll do sequence number 20. So let the arrow key a few times and we'll do

113
05:22.490 --> 05:23.440
sequence 20. But this

114
05:23.440 --> 05:27.630
time we want to match on IP address 102. So I'll hit the arrow key a few times

115
05:27.630 --> 05:28.400
and then go ahead and

116
05:28.400 --> 05:32.800
change it to 102. For this sequence number what we want to have happen is if
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
05:28.400 --> 05:32.800
change it to 102. For this sequence number what we want to have happen is if

117
05:32.800 --> 05:33.760
traffic is coming from

118
05:33.760 --> 05:38.690
the server at .100 matching on access list 102 we want to go ahead and set the

119
05:38.690 --> 05:41.600
next top to be 10.78.0.7.

120
05:41.600 --> 05:47.600
So we'll set IP next top to 10.78.0.7 and let's just verify that's our correct

121
05:47.600 --> 05:48.880
address there. So

122
05:48.880 --> 05:54.400
10.78.0.7 just for granted let's go to our 7 to show IP interface brief just to

123
05:54.400 --> 05:54.800
confirm that

124
05:54.800 --> 05:58.930
really is the address on its 0, 3/1 interface which it is fantastic. All right

125
05:58.930 --> 06:00.240
so back to R8 we go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
05:58.930 --> 06:00.240
so back to R8 we go

126
06:00.240 --> 06:04.360
and here at R8 the next thing we need to do is apply this to the interface now

127
06:04.360 --> 06:05.120
in our topology we

128
06:05.120 --> 06:10.250
want to apply this to gig 00 here on R8. So inbound traffic that's coming from

129
06:10.250 --> 06:11.360
PC8 or from server

130
06:11.360 --> 06:16.450
nug if it matches the access control list as part of the route map. Once we

131
06:16.450 --> 06:17.760
apply this to gig 00

132
06:17.760 --> 06:21.500
have policy based routing enabled for those two specific traffic flows. So we

133
06:21.500 --> 06:22.240
'll go ahead and

134
06:22.240 --> 06:27.640
go to interface gig 00 and the syntax to apply is IP policy then we'll specify

135
06:27.640 --> 06:28.640
the route map we

136
06:28.640 --> 06:31.910
want to use and then I'm going to copy paste it right here to make sure I don't
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
06:28.640 --> 06:31.910
want to use and then I'm going to copy paste it right here to make sure I don't

137
06:31.910 --> 06:32.480
have a typo

138
06:32.480 --> 06:37.040
and press center and then to verify that we do a show access list to verify the

139
06:37.040 --> 06:37.680
contents of our

140
06:37.680 --> 06:41.490
access control list fantastic. We do a show route map you look at the contents

141
06:41.490 --> 06:42.400
of our route map

142
06:42.400 --> 06:46.560
with the two sequences so here sequence 10 if we match an ACL 101 the next top

143
06:46.560 --> 06:47.680
is going to be 10.3.0.7.

144
06:47.680 --> 06:52.830
0.3 if that doesn't match and we do match on sequence 20 which is looking at

145
06:52.830 --> 06:54.160
access list 102 it'll

146
06:54.160 --> 06:58.520
set the next top to 10.7807 and currently we have zero packets and zero bytes

147
06:58.520 --> 06:59.360
for each of them because

148
06:59.360 --> 07:02.500
we haven't sent traffic through yet that matches and to confirm where it's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
06:59.360 --> 07:02.500
we haven't sent traffic through yet that matches and to confirm where it's

149
07:02.500 --> 07:04.080
applied we can do a show

150
07:04.080 --> 07:09.380
IP policy just like that and that confirms that our route map called pbr is

151
07:09.380 --> 07:11.600
applied on the gig 00 interface

152
07:11.600 --> 07:14.860
let's generate some traffic let's go back to the command line right here on

153
07:14.860 --> 07:15.760
server one so we're

154
07:15.760 --> 07:19.050
sitting right here at server one nug and in our topology that has the IP

155
07:19.050 --> 07:21.360
address of 192 168 1.100 and

156
07:21.360 --> 07:25.260
based on the policy based routing we just set up on our eight this trace that

157
07:25.260 --> 07:26.160
we just did from

158
07:26.160 --> 07:32.480
the source address of 192 168 1.100 going to 7777 if it's using ICMP which the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
07:26.160 --> 07:32.480
the source address of 192 168 1.100 going to 7777 if it's using ICMP which the

159
07:32.480 --> 07:33.840
trace from windows does

160
07:33.840 --> 07:38.190
use ICMP that should match and instead of going all the way around the horn

161
07:38.190 --> 07:39.200
this traffic should be

162
07:39.200 --> 07:43.170
policy based routed right over directly to our seven over the serial link so

163
07:43.170 --> 07:44.160
let's also before we

164
07:44.160 --> 07:48.610
do that let's go back to the console for our eight and let's do a debug IP

165
07:48.610 --> 07:50.480
policy and there we go and

166
07:50.480 --> 07:53.830
there is some traffic that's currently being forwarded it's having rejected by

167
07:53.830 --> 07:54.640
the policy because

168
07:54.640 --> 08:01.460
it's not matching it's traffic from dot 100 going to 192 203 2310 and another
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
07:54.640 --> 08:01.460
it's not matching it's traffic from dot 100 going to 192 203 2310 and another

169
08:01.460 --> 08:04.400
address of 192 12364

170
08:04.400 --> 08:07.160
however that's not matching our policy that's why we have all the reject

171
08:07.160 --> 08:08.400
messages so if we go back

172
08:08.400 --> 08:12.270
to our command prompt here and let's go ahead and do a trace route again to

173
08:12.270 --> 08:13.520
that destination press

174
08:13.520 --> 08:18.210
enter all of this traffic should be matched by the policy and as a result that

175
08:18.210 --> 08:19.040
's why we have the

176
08:19.040 --> 08:22.210
direct path from our eight going over to our seven instead of going through

177
08:22.210 --> 08:23.440
this path it was previously

178
08:23.440 --> 08:28.690
and if we go back to the console for our eight we should also see it indicated

179
08:28.690 --> 08:29.920
here that we had

180
08:29.920 --> 08:33.830
policy based matches and as a result we had policy based routing so if we did a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
08:29.920 --> 08:33.830
policy based matches and as a result we had policy based routing so if we did a

181
08:33.830 --> 08:34.800
show route map

182
08:34.800 --> 08:39.310
and press enter in those here for secos 20 it shows us we had six packets and 6

183
08:39.310 --> 08:40.480
36 bytes matching

184
08:40.480 --> 08:45.690
that policy and that's the traffic coming from the server at dot 100 going over

185
08:45.690 --> 08:46.800
to seven seven seven

186
08:46.800 --> 08:52.280
seven using ICMP so let's also test traffic from PC eight so we're going to PC

187
08:52.280 --> 08:53.360
eight previously we

188
08:53.360 --> 08:56.980
needed a trace using ICMP it went through the whole process it went through all

189
08:56.980 --> 08:57.600
this route but

190
08:57.600 --> 09:01.430
check it out now because we have the next top of dot three here it was policy
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
08:57.600 --> 09:01.430
check it out now because we have the next top of dot three here it was policy

191
09:01.430 --> 09:02.320
based route it we

192
09:02.320 --> 09:05.940
could also confirm that by using a different protocol so if we use something

193
09:05.940 --> 09:07.200
other than ICMP let's say

194
09:07.200 --> 09:11.300
for example we use TCP for that trace now we're using the normal forwarding

195
09:11.300 --> 09:13.120
table because the access

196
09:13.120 --> 09:18.780
control is looking specifically for ICMP traffic from our source address of PC

197
09:18.780 --> 09:19.760
eight going to the

198
09:19.760 --> 09:23.190
destination IP address of seven seven seven seven and so if we hit the upper

199
09:23.190 --> 09:24.080
key a couple times

200
09:24.080 --> 09:28.400
used ICMP again we have a shorter path through the policy based routing and if

201
09:28.400 --> 09:30.160
we head over to our eight
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

201
09:28.400 --> 09:30.160
we head over to our eight

202
09:30.160 --> 09:34.150
we can also see that we had a whole bunch of packets that were indeed policy

203
09:34.150 --> 09:34.880
based route it

204
09:34.880 --> 09:38.660
as shown like go ahead and turn the debugging off on all and scroll up a little

205
09:38.660 --> 09:39.680
bit so as shown right

206
09:39.680 --> 09:42.420
here we had a whole bunch of traffic that was policy based route it now one of

207
09:42.420 --> 09:43.360
the interesting things

208
09:43.360 --> 09:47.120
about policy based routing is that by default when we apply the policy to an

209
09:47.120 --> 09:48.000
interface it applies

210
09:48.000 --> 09:52.160
to ingress or inbound traffic going into the router on that interface but if we

211
09:52.160 --> 09:53.040
want policy based

212
09:53.040 --> 09:57.370
routing to apply to traffic that the router itself is generating for example it

213
09:57.370 --> 09:57.920
's generating a

214
09:57.920 --> 10:02.380
ping or a trace or it's reaching out with telnet or ssh another system if we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

214
09:57.920 --> 10:02.380
ping or a trace or it's reaching out with telnet or ssh another system if we

215
10:02.380 --> 10:03.360
want that traffic

216
10:03.360 --> 10:07.000
source by the router itself to be policy based routed but we need to set up

217
10:07.000 --> 10:07.920
this what's called a

218
10:07.920 --> 10:11.700
local policy and the great news is that in the next video i'm going to walk you

219
10:11.700 --> 10:12.800
through exactly

220
10:12.800 --> 10:17.200
that so i'll see you in the next video in just a moment