1
00:00:00,000 --> 00:00:03,451
[AUDIO LOGO]

2
00:00:03,451 --> 00:00:07,900

3
00:00:07,900 --> 00:00:09,910
So as we jump into
our discussion

4
00:00:09,910 --> 00:00:12,940
of advanced filtering,
the first thing to look at

5
00:00:12,940 --> 00:00:14,830
is going to be route maps.

6
00:00:14,830 --> 00:00:17,740
Now we can certainly
use route maps

7
00:00:17,740 --> 00:00:19,707
for advanced filtering,
which is what

8
00:00:19,707 --> 00:00:21,540
we're going to be
focusing on in this skill.

9
00:00:21,540 --> 00:00:25,930
However, keep in mind
that route maps can also

10
00:00:25,930 --> 00:00:30,590
be used in a lot of situations
to manipulate routes,

11
00:00:30,590 --> 00:00:35,140
so change things like BGP
attributes or the metric

12
00:00:35,140 --> 00:00:36,980
on a route, things like that.

13
00:00:36,980 --> 00:00:39,890
Now, of course, our focus
here is on filtering.

14
00:00:39,890 --> 00:00:42,080
So that's what we'll
be focusing on.

15
00:00:42,080 --> 00:00:44,890
But keep in mind they
do have many more uses.

16
00:00:44,890 --> 00:00:48,940
Where they become very handy
from a filtering perspective

17
00:00:48,940 --> 00:00:52,100
is when we need to filter
on more advanced things.

18
00:00:52,100 --> 00:00:57,790
So maybe we want to filter
with an ACL and a prefix list.

19
00:00:57,790 --> 00:01:01,420
Or maybe we want to use
multiple prefix lists.

20
00:01:01,420 --> 00:01:04,209
Maybe we want to
match on something

21
00:01:04,209 --> 00:01:09,520
that can't be matched on with
an ACL or a prefix list, maybe

22
00:01:09,520 --> 00:01:12,430
the type of route
that it is or maybe

23
00:01:12,430 --> 00:01:14,600
the route source
that it came from.

24
00:01:14,600 --> 00:01:16,930
In the case of some
routing protocols,

25
00:01:16,930 --> 00:01:20,110
if the route was redistributed,
if it's external,

26
00:01:20,110 --> 00:01:23,230
we can even filter based
on the routing protocol

27
00:01:23,230 --> 00:01:24,950
it originated from.

28
00:01:24,950 --> 00:01:26,710
Now the only routing
protocol that

29
00:01:26,710 --> 00:01:30,670
truly supports that is EIGRP,
which is, of course, not

30
00:01:30,670 --> 00:01:32,180
one of our focuses here.

31
00:01:32,180 --> 00:01:34,610
But it is something
to be aware of.

32
00:01:34,610 --> 00:01:37,750
So what we want to do
is jump in and start

33
00:01:37,750 --> 00:01:39,100
looking at these route maps.

34
00:01:39,100 --> 00:01:41,200
We'll start by looking
at their structure,

35
00:01:41,200 --> 00:01:44,740
how we match on things,
how we can set parameters--

36
00:01:44,740 --> 00:01:46,420
we will cover that--

37
00:01:46,420 --> 00:01:50,650
and how to do multiple
matching, how those attributes

38
00:01:50,650 --> 00:01:55,480
work if we say match on to
prefix lists or a prefix list

39
00:01:55,480 --> 00:01:56,830
in an ACL.

40
00:01:56,830 --> 00:02:00,490
So that's going to be our
main focus in this video.

41
00:02:00,490 --> 00:02:03,170
And then, of course,
in our next video,

42
00:02:03,170 --> 00:02:05,540
we'll jump in and see an
example of these working.

43
00:02:05,540 --> 00:02:08,740
So let's go ahead and jump in
and just talk about the logic

44
00:02:08,740 --> 00:02:10,300
and structure of the route-map.

45
00:02:10,300 --> 00:02:13,410
Let's go ahead and get started.

46
00:02:13,410 --> 00:02:14,930
So the first thing
to discuss here

47
00:02:14,930 --> 00:02:19,460
is, of course, that the reason
we need these is our filtering

48
00:02:19,460 --> 00:02:21,980
can, of course, get
more complicated

49
00:02:21,980 --> 00:02:27,200
than what we can just do with
either an ACL or a prefix list,

50
00:02:27,200 --> 00:02:30,390
as we've discussed
in previous skills.

51
00:02:30,390 --> 00:02:34,340
So the real issue is we may
want to match on both of these.

52
00:02:34,340 --> 00:02:38,090
Maybe we want to match on
an ACL and a prefix list.

53
00:02:38,090 --> 00:02:41,450
Or as I said in the
introduction, maybe

54
00:02:41,450 --> 00:02:44,180
we want to match on something
completely different

55
00:02:44,180 --> 00:02:47,810
because an ACL and a prefix
list are limited to matching

56
00:02:47,810 --> 00:02:49,340
on the prefix itself.

57
00:02:49,340 --> 00:02:52,050
And maybe that's not what
we're trying to match on.

58
00:02:52,050 --> 00:02:55,370
So route maps just give
us a lot more options

59
00:02:55,370 --> 00:02:59,210
and a more complicated,
almost programmatic way

60
00:02:59,210 --> 00:03:02,120
of doing this, where
a route-map actually

61
00:03:02,120 --> 00:03:03,710
acts a lot like a script.

62
00:03:03,710 --> 00:03:06,710
And we'll see that as
we go through here.

63
00:03:06,710 --> 00:03:09,470
Now as far as the
platforms we're discussing,

64
00:03:09,470 --> 00:03:14,090
this is going to be the
solution available on IOS XE.

65
00:03:14,090 --> 00:03:18,110
Of course, IOS XR, we'll be
talking about in a little bit.

66
00:03:18,110 --> 00:03:19,790
That has a different solution.

67
00:03:19,790 --> 00:03:21,620
That's the RPL.

68
00:03:21,620 --> 00:03:26,060
But this is our solution for
those more advanced filtering

69
00:03:26,060 --> 00:03:28,940
and manipulation situations.

70
00:03:28,940 --> 00:03:30,980
Again, our focus
right now is not

71
00:03:30,980 --> 00:03:33,090
going to be on the
manipulation part.

72
00:03:33,090 --> 00:03:37,190
We will be doing plenty of
that in upcoming skills.

73
00:03:37,190 --> 00:03:39,290
Now the way these
are structured is

74
00:03:39,290 --> 00:03:42,590
we have different
numbered statements.

75
00:03:42,590 --> 00:03:46,040
These statements are going
to be executed in order.

76
00:03:46,040 --> 00:03:48,200
And each statement
is either going

77
00:03:48,200 --> 00:03:51,860
to be configured generally
to permit or deny

78
00:03:51,860 --> 00:03:56,610
whatever traffic matches
that particular statement.

79
00:03:56,610 --> 00:04:00,390
So we'll have to focus in on
how the matching actually works.

80
00:04:00,390 --> 00:04:04,770
Now, again, these can work
for traffic or routes.

81
00:04:04,770 --> 00:04:07,470
Route maps were
technically designed

82
00:04:07,470 --> 00:04:11,280
for Policy-Based
Routing, or PBR.

83
00:04:11,280 --> 00:04:13,590
Now this is another one
of those features that

84
00:04:13,590 --> 00:04:16,800
works very nicely when it comes
to route manipulation and route

85
00:04:16,800 --> 00:04:19,589
filtering, sort of
like ACLs were actually

86
00:04:19,589 --> 00:04:21,990
designed as packet filters.

87
00:04:21,990 --> 00:04:24,360
But we can use them
to match on traffic.

88
00:04:24,360 --> 00:04:25,660
Same thing here.

89
00:04:25,660 --> 00:04:29,070
So when we say that they're
used to match on traffic, that's

90
00:04:29,070 --> 00:04:30,870
usually what we're
referring to, is

91
00:04:30,870 --> 00:04:34,870
that we can use these for
policy-based routing as well.

92
00:04:34,870 --> 00:04:36,870
But, again, our
focus right now is

93
00:04:36,870 --> 00:04:40,110
going to be on using them
for filtering routes.

94
00:04:40,110 --> 00:04:42,480
Now as far as the
matching goes, we

95
00:04:42,480 --> 00:04:46,390
do have a few options
available to us.

96
00:04:46,390 --> 00:04:49,500
First is we can have
no match statement.

97
00:04:49,500 --> 00:04:53,040
If you have no match
statement, then it

98
00:04:53,040 --> 00:04:55,680
defaults to matching any.

99
00:04:55,680 --> 00:05:00,495
So having no match statement
at all same as a match-any.

100
00:05:00,495 --> 00:05:03,420
You can have a single
match statement.

101
00:05:03,420 --> 00:05:07,350
If there's a single match
statement, then quite simply,

102
00:05:07,350 --> 00:05:10,450
we just have to match
that single statement.

103
00:05:10,450 --> 00:05:12,840
Now at first, that may sound
like a silly statement.

104
00:05:12,840 --> 00:05:14,460
But when you see
the other choices,

105
00:05:14,460 --> 00:05:16,740
it'll make a little
bit more sense,

106
00:05:16,740 --> 00:05:20,850
because then we introduce
a single match statement

107
00:05:20,850 --> 00:05:23,980
but then with multiple elements.

108
00:05:23,980 --> 00:05:27,960
So for example, maybe we
say to match a prefix list,

109
00:05:27,960 --> 00:05:31,380
but then we list
for prefix lists.

110
00:05:31,380 --> 00:05:36,810
Then we have to match any
element in that statement.

111
00:05:36,810 --> 00:05:39,780
And since we can match
on any of the elements,

112
00:05:39,780 --> 00:05:43,380
that makes it act
like a logical OR.

113
00:05:43,380 --> 00:05:48,970
So you can match on prefix
list 1 or 2 or 3 and so on.

114
00:05:48,970 --> 00:05:53,580
So if it's multiple elements,
it's going to be an OR.

115
00:05:53,580 --> 00:05:58,770
The next choice is to have
multiple match statements.

116
00:05:58,770 --> 00:06:03,000
So you might say match a
prefix list and match an ACL

117
00:06:03,000 --> 00:06:05,280
and match a route source.

118
00:06:05,280 --> 00:06:07,230
And you can even hear
the way I'm saying it.

119
00:06:07,230 --> 00:06:10,560
This is, of course, going
to be a logical AND.

120
00:06:10,560 --> 00:06:12,510
If there are
multiple statements,

121
00:06:12,510 --> 00:06:16,120
we have to match all
of the statements.

122
00:06:16,120 --> 00:06:17,460
So this is not an any.

123
00:06:17,460 --> 00:06:19,620
This is going to be an all.

124
00:06:19,620 --> 00:06:22,080
And, of course,
our last choice is

125
00:06:22,080 --> 00:06:24,700
going to be to put these
two things together.

126
00:06:24,700 --> 00:06:27,450
We might have multiple
match statements

127
00:06:27,450 --> 00:06:30,270
with multiple elements.

128
00:06:30,270 --> 00:06:34,360
And this is going to be
combining the any and the all.

129
00:06:34,360 --> 00:06:38,320
So we have to match
at least one element.

130
00:06:38,320 --> 00:06:41,580
So that's the OR up here.

131
00:06:41,580 --> 00:06:46,080
And we have to match it
in every match statement.

132
00:06:46,080 --> 00:06:48,420
That's the AND part.

133
00:06:48,420 --> 00:06:52,740
So this is combining
the OR and the AND.

134
00:06:52,740 --> 00:06:55,920
Once again, we have to match
at least one element out

135
00:06:55,920 --> 00:06:59,680
of each match statement.

136
00:06:59,680 --> 00:07:01,770
Now once the
traffic or the route

137
00:07:01,770 --> 00:07:04,570
actually matches a
particular statement,

138
00:07:04,570 --> 00:07:07,470
we then have to decide
what to do with it.

139
00:07:07,470 --> 00:07:11,790
Well, if the statement
is overall a deny,

140
00:07:11,790 --> 00:07:15,070
well, then that traffic or
route is going to be dropped.

141
00:07:15,070 --> 00:07:16,830
That's what the deny means.

142
00:07:16,830 --> 00:07:20,590
If this statement
is overall a permit,

143
00:07:20,590 --> 00:07:22,860
then we actually have
a few things we do.

144
00:07:22,860 --> 00:07:26,550
First is the traffic or
route will be permitted.

145
00:07:26,550 --> 00:07:29,460
That's, again, what
that statement means.

146
00:07:29,460 --> 00:07:34,030
But this falls into the
manipulation category.

147
00:07:34,030 --> 00:07:38,310
All applicable set
commands are applied

148
00:07:38,310 --> 00:07:41,070
to the traffic or route.

149
00:07:41,070 --> 00:07:43,440
Now just as a real
quick note, what

150
00:07:43,440 --> 00:07:46,740
do we mean by
applicable set commands?

151
00:07:46,740 --> 00:07:49,350
Well, you could put
in a set command,

152
00:07:49,350 --> 00:07:53,940
for example, that says to set
the local preference to 100.

153
00:07:53,940 --> 00:07:58,080
But then you try to apply
that to an OSPF route.

154
00:07:58,080 --> 00:08:00,420
OSPF doesn't have
local preference.

155
00:08:00,420 --> 00:08:03,420
That's something we
can only set in BGP.

156
00:08:03,420 --> 00:08:06,660
So if there are set
statements that just flat out

157
00:08:06,660 --> 00:08:10,260
don't apply to whatever
type of traffic or route

158
00:08:10,260 --> 00:08:12,360
that you're trying
to apply it to,

159
00:08:12,360 --> 00:08:15,030
the route-map will
simply skip that and not

160
00:08:15,030 --> 00:08:17,230
do that set statement.

161
00:08:17,230 --> 00:08:20,640
So once the traffic or route
has been permitted and set,

162
00:08:20,640 --> 00:08:24,120
then what we do is we
exit the route-map,

163
00:08:24,120 --> 00:08:26,790
and we stop processing.

164
00:08:26,790 --> 00:08:33,179
Or we continue to the next
or designated statement.

165
00:08:33,179 --> 00:08:36,240
There's a continue command.

166
00:08:36,240 --> 00:08:38,070
And we'll see that
in our example

167
00:08:38,070 --> 00:08:41,159
here in just a moment
where you can actually

168
00:08:41,159 --> 00:08:44,100
have it continue
processing the route-map

169
00:08:44,100 --> 00:08:46,080
and do other statements.

170
00:08:46,080 --> 00:08:49,200
You can specify a number
and have it jump ahead.

171
00:08:49,200 --> 00:08:52,050
Or you can not specify
a number, and it'll just

172
00:08:52,050 --> 00:08:53,920
continue to the next statement.

173
00:08:53,920 --> 00:08:57,270
So the best way to understand
all of this together

174
00:08:57,270 --> 00:09:00,640
is just to walk through
a real simple example.

175
00:09:00,640 --> 00:09:03,570
So let's go ahead and do that.

176
00:09:03,570 --> 00:09:06,320
So, first, let's start
with the overall structure.

177
00:09:06,320 --> 00:09:09,020
We can see here that we
have a single route-map

178
00:09:09,020 --> 00:09:13,110
because all of the statements
have the same name.

179
00:09:13,110 --> 00:09:16,100
So this is all a
single route-map.

180
00:09:16,100 --> 00:09:18,590
Here, we see that,
overall, these statements

181
00:09:18,590 --> 00:09:21,410
are either permits or denies.

182
00:09:21,410 --> 00:09:23,810
And we see that
each statement has

183
00:09:23,810 --> 00:09:26,750
a sequence number or
a statement number

184
00:09:26,750 --> 00:09:28,770
to keep them in
the correct order.

185
00:09:28,770 --> 00:09:31,770
This also, of course, allows us
to insert things in the middle

186
00:09:31,770 --> 00:09:33,300
and so on.

187
00:09:33,300 --> 00:09:36,660
But then let's talk about what's
in each of these statements.

188
00:09:36,660 --> 00:09:39,500
So starting with
statement 10, we

189
00:09:39,500 --> 00:09:42,740
have a match on the IP address.

190
00:09:42,740 --> 00:09:46,110
And it's, for this, going
to use a prefix list.

191
00:09:46,110 --> 00:09:48,770
And in this case, it's going
to be either prefix list 1

192
00:09:48,770 --> 00:09:50,840
or prefix list 2.

193
00:09:50,840 --> 00:09:52,740
This is that example
where we said,

194
00:09:52,740 --> 00:09:55,400
if we have two
elements on here, this

195
00:09:55,400 --> 00:09:58,160
is where it's going
to be a logical OR.

196
00:09:58,160 --> 00:10:01,400
If our traffic or route matches
either one of those prefix

197
00:10:01,400 --> 00:10:04,550
lists, it would
match this statement.

198
00:10:04,550 --> 00:10:07,130
And if it matches
this statement,

199
00:10:07,130 --> 00:10:09,150
what are we going to do?

200
00:10:09,150 --> 00:10:12,050
We're going to set
the IP next-hop

201
00:10:12,050 --> 00:10:15,260
to the address of 10.1.1.1.

202
00:10:15,260 --> 00:10:18,020
And then we're
going to continue.

203
00:10:18,020 --> 00:10:21,650
Now if this statement
was not here,

204
00:10:21,650 --> 00:10:24,470
if there was no
continue 50, this

205
00:10:24,470 --> 00:10:26,720
is what we mean that it would
then exit the route-map.

206
00:10:26,720 --> 00:10:29,090
And it would be done processing.

207
00:10:29,090 --> 00:10:31,430
But since there
is a continue 50,

208
00:10:31,430 --> 00:10:33,660
it's going to continue to 50.

209
00:10:33,660 --> 00:10:35,240
And since there's
a number specified,

210
00:10:35,240 --> 00:10:37,580
that means it's going
to come down here.

211
00:10:37,580 --> 00:10:41,570
And we're going to process
this last statement, which,

212
00:10:41,570 --> 00:10:43,190
since there's no
match statement,

213
00:10:43,190 --> 00:10:45,740
means it's going
to match anything.

214
00:10:45,740 --> 00:10:49,640
And we're going to
set the metric to 100.

215
00:10:49,640 --> 00:10:52,940
That's all what's going to
happen if our traffic matches

216
00:10:52,940 --> 00:10:55,020
statement 10.

217
00:10:55,020 --> 00:10:56,760
But what if it doesn't?

218
00:10:56,760 --> 00:11:01,130
So now traffic comes in that
does not match prefix list

219
00:11:01,130 --> 00:11:03,437
1 or prefix list 2.

220
00:11:03,437 --> 00:11:05,270
So now what we're going
to do is we're going

221
00:11:05,270 --> 00:11:08,360
to proceed to statement 20.

222
00:11:08,360 --> 00:11:12,650
On statement 20, it says
to match the IP address

223
00:11:12,650 --> 00:11:14,990
based on these two ACLs.

224
00:11:14,990 --> 00:11:18,020
This, again, is going to
be an OR because there's

225
00:11:18,020 --> 00:11:20,030
two on the same line.

226
00:11:20,030 --> 00:11:22,670
And then this is
going to be an AND.

227
00:11:22,670 --> 00:11:26,030
It has to match on
both of these lines.

228
00:11:26,030 --> 00:11:28,400
Does it also match
the route source

229
00:11:28,400 --> 00:11:32,810
based on the prefix
list PL_SOURCE1?

230
00:11:32,810 --> 00:11:37,130
So this is an example of
combining an AND and an OR.

231
00:11:37,130 --> 00:11:42,080
So it has to match both the
address and the route source.

232
00:11:42,080 --> 00:11:46,940
But for the address, it can
be either ACL 1 or ACL 2.

233
00:11:46,940 --> 00:11:51,140
If those things are true,
if it matches both of those,

234
00:11:51,140 --> 00:11:52,640
then what we're
going to do is we're

235
00:11:52,640 --> 00:11:54,830
going to set the tag to 100.

236
00:11:54,830 --> 00:11:56,570
And, once again,
we continue to 50.

237
00:11:56,570 --> 00:11:58,280
So it's going to come down here.

238
00:11:58,280 --> 00:12:01,350
And it's going to set
the metric to 100.

239
00:12:01,350 --> 00:12:04,670
That's what happens if
we match statement 20.

240
00:12:04,670 --> 00:12:07,400
If we don't match
statement 10 or 20,

241
00:12:07,400 --> 00:12:09,950
it, of course, goes on to 30.

242
00:12:09,950 --> 00:12:14,780
30 says to match on an
existing tag of 500.

243
00:12:14,780 --> 00:12:17,000
If we match on
that existing tag,

244
00:12:17,000 --> 00:12:20,510
it's then going to
set the metric to 500

245
00:12:20,510 --> 00:12:22,580
and exit the route-map.

246
00:12:22,580 --> 00:12:25,160
It's exiting the route-map
because there's no continue

247
00:12:25,160 --> 00:12:28,310
statement on statement 30.

248
00:12:28,310 --> 00:12:30,530
So it will stop processing.

249
00:12:30,530 --> 00:12:31,880
It'll do those two things.

250
00:12:31,880 --> 00:12:34,340
In other words, it
will permit the traffic

251
00:12:34,340 --> 00:12:39,950
and set the metric to 500 and
then stop route-map processing.

252
00:12:39,950 --> 00:12:43,190
If we don't match
statement 30, it's

253
00:12:43,190 --> 00:12:45,020
going to get to statement 40.

254
00:12:45,020 --> 00:12:48,440
And, of course, statement
40 says to deny.

255
00:12:48,440 --> 00:12:51,500
And it has no match
statement here.

256
00:12:51,500 --> 00:12:55,800
With no match statement,
that matches everything.

257
00:12:55,800 --> 00:12:58,820
So everything else
will be denied.

258
00:12:58,820 --> 00:13:04,830
Overall, this is how
route-map processing works.

259
00:13:04,830 --> 00:13:09,020
So in this video, we took a
look at the overall structure

260
00:13:09,020 --> 00:13:12,440
and processing of a route-map.

261
00:13:12,440 --> 00:13:14,420
We got to see how the
continue statement

262
00:13:14,420 --> 00:13:17,900
works, a little bit about match
statements and set statements.

263
00:13:17,900 --> 00:13:20,270
We will, of course,
be using these

264
00:13:20,270 --> 00:13:22,550
all throughout
this entire course.

265
00:13:22,550 --> 00:13:24,950
But this is a good
introduction to their structure

266
00:13:24,950 --> 00:13:27,950
and how they're actually
built and processed.

267
00:13:27,950 --> 00:13:32,960
Also keep in mind that these can
use the ACLs and the prefixes

268
00:13:32,960 --> 00:13:37,910
and match on other things that
we'll see in our CLI example.

269
00:13:37,910 --> 00:13:40,320
And that's what we're going
to do in the next video.

270
00:13:40,320 --> 00:13:42,050
We're going to jump
into the command line

271
00:13:42,050 --> 00:13:47,690
and see a route-map in
use, both in OSPF and ISIS.

272
00:13:47,690 --> 00:13:51,260
Until then, I hope this has
been informative for you.

273
00:13:51,260 --> 00:13:54,280
And I'd like to thank
you for viewing.

274
00:13:54,280 --> 00:13:58,000