WEBVTT

1
00:00.000 --> 00:03.000
In this video, we get to take a look at the configuration

2
00:03.000 --> 00:07.400
and verification of local policies with policy-based routing.

3
00:07.400 --> 00:09.360
Because by default, when we do policy-based routing,

4
00:09.360 --> 00:11.120
we apply the policy to an interface

5
00:11.120 --> 00:13.640
that's supplying to traffic coming in from another device

6
00:13.640 --> 00:14.640
on that interface.

7
00:14.640 --> 00:16.760
However, with the local policy with PBR,

8
00:16.760 --> 00:18.680
we can tell the router, hey, guess what?

9
00:18.680 --> 00:20.480
Traffic that matches the policy,

10
00:20.480 --> 00:22.040
even if that's traffic that you generated

11
00:22.040 --> 00:24.240
or self-Mr. router, we want you to go ahead

12
00:24.240 --> 00:27.240
and do policy-based routing on that locally generated traffic.

13
00:27.240 --> 00:29.360
So here's what I propose we do as an example.

14
00:29.360 --> 00:31.520
Let's use our router we haven't used yet for this.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.360 --> 00:31.520
Let's use our router we haven't used yet for this.

15
00:31.520 --> 00:32.680
Let's use our four.

16
00:32.680 --> 00:33.920
So our four will be the router

17
00:33.920 --> 00:35.320
where we're going to set up a local policy

18
00:35.320 --> 00:36.720
with policy-based routing.

19
00:36.720 --> 00:38.960
And let's specify that on our four traffic

20
00:38.960 --> 00:41.680
that our four sources, if it's sourced

21
00:41.680 --> 00:43.760
from the loopback zero interface, which is four.

22
00:43.760 --> 00:45.360
four. four. four. four.

23
00:45.360 --> 00:48.000
So if the source address is four, four, four, four,

24
00:48.000 --> 00:50.040
and if the destination address is anywhere down here

25
00:50.040 --> 00:53.040
on the 1017 network, so the 10.1.7.0/24,

26
00:53.040 --> 00:58.840
so we'll use some wildcard bits in our ACL to indicate that.

27
00:58.840 --> 01:03.400
And for the protocol, let's go ahead and just do all IPV4 protocols.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.840 --> 01:03.400
And for the protocol, let's go ahead and just do all IPV4 protocols.

28
01:03.400 --> 01:07.800
So whether it's GRE or TCP or UDP or ICMP,

29
01:07.800 --> 01:08.960
we'll just include it all.

30
01:08.960 --> 01:11.000
And we'll focus primarily on the source

31
01:11.000 --> 01:12.600
and destination address space.

32
01:12.600 --> 01:15.680
Now currently the routing table says go north.

33
01:15.680 --> 01:16.920
And if you're going to forward down

34
01:16.920 --> 01:18.880
to this network right down here,

35
01:18.880 --> 01:21.440
that's based on the OSPF that's currently set up.

36
01:21.440 --> 01:23.040
And then our two is going to set it here

37
01:23.040 --> 01:24.800
and our one's going to set down here,

38
01:24.800 --> 01:26.080
our three is going to set it down here,

39
01:26.080 --> 01:28.200
and our five is going to set it down here.

40
01:28.200 --> 01:30.000
And before we actually set this up, let's take a moment
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:30.000 --> 01:33.360
and just to verify that indeed is the case here on router four.

42
01:33.360 --> 01:35.200
So let's head over to router four

43
01:35.200 --> 01:37.280
and just verify a couple of things.

44
01:37.280 --> 01:38.760
First of all, make sure you get on the right router.

45
01:38.760 --> 01:41.040
Let's do a show IP interface brief

46
01:41.040 --> 01:43.880
just to make sure it's loopback really is four, four, four, four, four.

47
01:43.880 --> 01:49.080
And for a test, let's go ahead and do a ping down to PC7,

48
01:49.080 --> 01:51.520
which is at 10.1.7.10.

49
01:51.520 --> 01:54.720
So we'll do a ping to 10.1.7.10.

50
01:54.720 --> 01:57.240
And we'll source it from loopback zero.

51
01:57.240 --> 01:59.240
And sorry, says, yeah, that works.

52
01:59.240 --> 02:03.000
And also the trace, so we'll swap out the word ping with trace.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.240 --> 02:03.000
And also the trace, so we'll swap out the word ping with trace.

53
02:03.000 --> 02:05.120
And it wants to see, I'll give it the C

54
02:05.120 --> 02:07.560
for the full word of trace, short for trace route.

55
02:07.560 --> 02:08.880
And there's our path through the network.

56
02:08.880 --> 02:13.040
So from R4, going to R2, then going to R1,

57
02:13.040 --> 02:15.000
and then down the left hand side down to R7.

58
02:15.000 --> 02:17.000
And that's for traffic that R4 itself is generating.

59
02:17.000 --> 02:19.000
The ping was sourced and the trace route was sourced,

60
02:19.000 --> 02:21.000
both here from R4.

61
02:21.000 --> 02:22.960
So let's go ahead and create an access control list

62
02:22.960 --> 02:24.720
to match on the traffic.

63
02:24.720 --> 02:26.720
So we'll show access list to see what we're starting with.

64
02:26.720 --> 02:29.000
Fantastic, we'll go into configuration mode.

65
02:29.000 --> 02:32.560
Let's create access list 104, and we'll permit.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.000 --> 02:32.560
Let's create access list 104, and we'll permit.

66
02:32.560 --> 02:35.360
And we'll specify IP, meaning any layer for protocol

67
02:35.360 --> 02:38.200
will match in a suite of IPv4.

68
02:38.200 --> 02:40.080
And for the source address, we'll use host

69
02:40.080 --> 02:43.120
to match on the loopback address of 4444.

70
02:43.120 --> 02:47.000
For the destination, we want to match on the 10.1.7 network.

71
02:47.000 --> 02:51.120
And so for wildcard bits, we'll go in 0.0.0.0.255.

72
02:51.120 --> 02:52.840
And that looks not good.

73
02:52.840 --> 02:54.320
So in my mind, I said destinations,

74
02:54.320 --> 02:55.760
I guess I started typing destinations,

75
02:55.760 --> 02:58.360
but the destination is the 10.1.7 network.

76
02:58.360 --> 02:59.680
And that looks even better.

77
02:59.680 --> 03:01.160
So next let's create a route map.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.680 --> 03:01.160
So next let's create a route map.

78
03:01.160 --> 03:02.720
Let's call it PBR.

79
03:02.720 --> 03:05.360
And it'll go ahead and be a permit statement.

80
03:05.360 --> 03:08.480
And we'll give it a sequence number of 10, an LL match,

81
03:08.480 --> 03:12.600
on the IP address that's indicated in access list 104.

82
03:12.600 --> 03:13.600
And we'll set the next top.

83
03:13.600 --> 03:18.920
If that matches, we'll set the next top to 10.0.34.3.

84
03:18.920 --> 03:20.520
And this just confirmed that address as well.

85
03:20.520 --> 03:23.400
So that would be going over to 10.0.34.3,

86
03:23.400 --> 03:24.800
which is the IP address of R3.

87
03:24.800 --> 03:27.840
So previously, it routed up through R2,

88
03:27.840 --> 03:29.480
then R1 to R3.

89
03:29.480 --> 03:33.000
And once this PBR kicks in with the local policy,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:29.480 --> 03:33.000
And once this PBR kicks in with the local policy,

90
03:33.000 --> 03:37.440
it'll forward directly over to R3 for that policy-based routing.

91
03:37.440 --> 03:40.080
Now previously, when we're applying this to traffic

92
03:40.080 --> 03:42.680
that's coming into the router, we apply it to an interface.

93
03:42.680 --> 03:46.760
However, to apply this policy for the local router itself,

94
03:46.760 --> 03:47.920
we're not going to get an interface.

95
03:47.920 --> 03:49.080
We're going to use a global command

96
03:49.080 --> 03:52.520
and that is IP local policy space.

97
03:52.520 --> 03:55.360
And then we'll specify a route map and our route map name,

98
03:55.360 --> 03:56.720
which is PBR.

99
03:56.720 --> 03:58.240
So I'll put that in right there.

100
03:58.240 --> 04:00.720
And then I'll type in N.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:58.240 --> 04:00.720
And then I'll type in N.

101
04:00.720 --> 04:01.760
I should have pressed that in our first place.

102
04:01.760 --> 04:05.640
Go ahead and do a control A. Say no, IP local policy,

103
04:05.640 --> 04:08.480
because that PBR end doesn't exist.

104
04:08.480 --> 04:09.840
Let the upper key a couple of times,

105
04:09.840 --> 04:12.160
we want the local policy to be PBR.

106
04:12.160 --> 04:13.400
And then we'll type in N.

107
04:13.400 --> 04:15.800
And then we'll go into a show IP policy.

108
04:15.800 --> 04:18.720
And this is showing us that we have a route map called PBR.

109
04:18.720 --> 04:21.400
And the interface, instead of specifying gig 0, 0,

110
04:21.400 --> 04:23.480
or gig 0, 1, et cetera, is local,

111
04:23.480 --> 04:26.040
meaning traffic that is sourced by the router.

112
04:26.040 --> 04:28.920
So previously, if we scroll up and we take a look at the path,

113
04:28.920 --> 04:33.080
we did previously for traffic that was going to 10.1.7.10,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:28.920 --> 04:33.080
we did previously for traffic that was going to 10.1.7.10,

114
04:33.080 --> 04:35.800
sourced from the back zero, it went from R4

115
04:35.800 --> 04:37.480
on the right-hand side of our topology.

116
04:37.480 --> 04:40.160
And the next top was R2, we then set it to R1.

117
04:40.160 --> 04:41.880
And what we're going to do now, based on traffic

118
04:41.880 --> 04:44.600
the matches that policy, R4 is going to set that traffic

119
04:44.600 --> 04:47.960
directly over to R3 instead of using the routing table,

120
04:47.960 --> 04:49.840
which would normally forward it up to R2.

121
04:49.840 --> 04:52.240
So let's go ahead and press enter,

122
04:52.240 --> 04:54.880
let the up here key a few times, and do that same trace,

123
04:54.880 --> 04:58.760
to 10.1.7.10, sourcing it from our loopback zero.

124
04:58.760 --> 05:00.360
So check it out this time, instead of setting it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
04:58.760 --> 05:00.360
So check it out this time, instead of setting it

125
05:00.360 --> 05:03.960
to the next top of R2, which would be end with the dot 2,

126
05:03.960 --> 05:05.640
it's going to direct the over to R3,

127
05:05.640 --> 05:09.120
we then routed it through R5, R5 routed it through R7,

128
05:09.120 --> 05:11.560
and then R7 delivered it to the client at dot 10.

129
05:11.560 --> 05:14.560
Anybody did a debug IP policy and press enter?

130
05:14.560 --> 05:17.640
Any traffic that is not matching the policy

131
05:17.640 --> 05:19.200
would be routed normally.

132
05:19.200 --> 05:20.920
And traffic that is matching the policy

133
05:20.920 --> 05:23.840
would be routed based on the policy based routing.

134
05:23.840 --> 05:26.440
So if we hit the upper key and do a trace again,

135
05:26.440 --> 05:27.680
we should have some matches here,

136
05:27.680 --> 05:29.080
and I'll do an undyboggall.

137
05:29.080 --> 05:31.400
So in notes here, we have this traffic was policy based
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
05:29.080 --> 05:31.400
So in notes here, we have this traffic was policy based

138
05:31.400 --> 05:34.040
routed that was sourced from 4444,

139
05:34.040 --> 05:35.840
going to 10.1.7.10.

140
05:35.840 --> 05:36.880
And if we do that trace again,

141
05:36.880 --> 05:39.360
but we didn't source it from a specific loopback interface,

142
05:39.360 --> 05:41.960
meaning it's going to source it from the routing table,

143
05:41.960 --> 05:44.240
it's interface closer to the destination,

144
05:44.240 --> 05:46.120
this one would go through the normal routing.

145
05:46.120 --> 05:48.520
So to 2 to 1 to 3 to 5 to 7,

146
05:48.520 --> 05:50.600
where if we source it from loopback zero,

147
05:50.600 --> 05:52.120
it's going to bypass two,

148
05:52.120 --> 05:53.720
it's going to set directly over to R3,

149
05:53.720 --> 05:55.320
who continues the routing process.

150
05:55.320 --> 05:57.240
So now that we have seen several examples

151
05:57.240 --> 05:59.840
of configuring and verifying policy based routing

152
05:59.840 --> 06:00.920
on a Cisco router,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

152
05:59.840 --> 06:00.920
on a Cisco router,

153
06:00.920 --> 06:03.240
in the next video I'd like to present you a hands-on lab.

154
06:03.240 --> 06:05.120
So you too, my friend, can get practice

155
06:05.120 --> 06:06.200
and build your skills.

156
06:06.200 --> 06:07.480
So when you're ready for a lab,

157
06:07.480 --> 06:10.160
I'll see you in the next video in just a moment.