The Mobile IP Home Agent Policy Routing feature supports route maps on Mobile IP tunnels created at the home agent. This feature allows an Internet Service Provider (ISP) to provide service to multiple customers. While reverse tunneling packets, the home agent looks up where the packet should go. For example, if an address corresponds to a configured network access identifier (NAI) realm name (such as cisco.com), the packet goes out interface 1, which has a connection to the Cisco network. If an address corresponds to another NAI realm name (such as company2.com), the packet goes out interface 2, which has a connection to the Company2 network.
Feature Specifications for Mobile IP Home Agent Policy Routing
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see
Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for Mobile IP Home Agent Policy Routing
Reverse tunnelling must be enabled on both the home agent and foreign agent.
Information About Mobile IP Home Agent Policy Routing
Policy routing is a more flexible mechanism for routing packets than destination routing. Policy routing allows network administrators to implement policies that selectively cause packets to take different paths. The policy can be as simple as not allowing any traffic from a department on a network or as complex as making sure traffic with certain characteristics originating within a network takes path A, while other traffic takes path B.
Policy routing is applied to incoming packets. All packets received on an interface with policy routing enabled are considered for policy routing. The router passes the packets through enhanced packet filters called route maps. The route map determines which packets are routed to which router next. Based on the criteria defined in the route maps, packets are forwarded/routed to the appropriate next hop.
Feature Design of Mobile IP Home Agent Policy Routing
The Mobile IP Home Agent Policy Routing feature allows policy routing for mobile nodes based on the NAI configuration. ISPs can use this feature to route traffic originating from different sets of users, as identified by the NAI realm name, through different Internet connections across the policy routers. When the mobile node registers, entries are added dynamically in the access list pointed to by the route map and the route map is applied to the tunnel interface.
A route map is configured and applied on the Mobile IP tunnel. When a packet arrives on a tunnel interface and policy routing is enabled on that tunnel (route map applied), the packet is checked against the access list configured on the route map.
The figure below shows a sample topology for home agent policy routing. In the figure, as traffic from firstname.lastname@example.org and u10@ company2.com is policy routed, the home agent forwards it per the policy instead of routing directly to the destination address.
Figure 1. Sample Topology for Mobile IP Home Agent Policy Routing
How to Configure Mobile IP Home Agent Policy Routing
Sample Output for the show ip mobile binding Command
The following is example output for a mobile host using the NAI realm of email@example.com:
Router# show ip mobile binding
Mobility Binding List:
firstname.lastname@example.org (Bindings 1):
Home Addr 184.108.40.206
Care-of Addr 220.127.116.11, Src Addr 18.104.22.168
Lifetime granted 00:05:00 (300), remaining 00:03:58
Flags sBdmgvT, Identification BF7A951C.28FA35AB
Tunnel1 src 22.214.171.124 dest 126.96.36.199 reverse-allowed
Routing Options - (T)Reverse-tunnel
Sample Output for the show ip mobile tunnel Command
The following example displays the active Mobile IP tunnels and the configured route map:
Router# show ip mobile tunnel
Total mobile ip tunnels 1
src 188.8.131.52, dest 184.108.40.206
encap IP/IP, mode reverse-allowed, tunnel-users 1
IP MTU 1514 bytes
Path MTU Discovery, mtu:0, ager:10 mins, expires:never
outbound interface Mobile0
HA created, fast switching enabled, ICMP unreachable enabled
10 packets input, 1000 bytes, 0 drops
5 packets output, 600 bytes
Route Map is:moipmap
Sample Output for the show access-lists Command
The following example displays the access list:
Router# show access-lists
Standard IP access list 5
Sample Output for the show ip policy Command
The following example displays the route maps applied to the tunnels:
Router# show ip policy
Interface Route map
Sample Output for the show ip mobile vpn-realm Command
The following examples show two VPN realms configured on the router with the corresponding show output:
ip mobile vpn-realm company1.com route-map-sequence 20
ip mobile vpn-realm company2.com route-map-sequence 10
Router# show ip mobile vpn-realm
IP Mobile VPN realm(s):
Sequence number: 20 Realm: company1.com
Sequence number: 10 Realm: company2.com
Configuration Examples for Mobile IP Home Agent Policy Routing
In the following example, the route map named moipmap is applied to the Mobile IP tunnel and traffic is routed, based on the NAI VPN realm configuration, through different connections across the policy routers:
ip mobile home-agent address 220.127.116.11 lifetime 65535 replay 255
ip mobile vpn-realm company2.com route-map-sequence 10
ip mobile virtual-network 18.104.22.168 255.0.0.0
ip mobile host nai email@example.com address 22.214.171.124 virtual-network 126.96.36.199 255.0.0.0
ip mobile host nai firstname.lastname@example.org address 188.8.131.52 virtual-network 184.108.40.206 255.0.0.0
ip mobile host nai email@example.com address 220.127.116.11 virtual-network 18.104.22.168 255.0.0.0
ip mobile host nai firstname.lastname@example.org address 22.214.171.124 virtual-network 126.96.36.199 255.0.0.0
ip mobile secure host nai email@example.com spi 100 key hex 12345678123456781234567812345678
ip mobile secure host nai firstname.lastname@example.org spi 100 key hex 45678123451234567812367812345678
ip mobile secure host nai email@example.com spi 100 key hex 81234567812345678123456712345678
ip mobile secure host nai firstname.lastname@example.org spi 100 key hex 23456781234567812345678123456781
ip mobile tunnel route-map moipmap
access-list 5 permit 188.8.131.52
route-map moipmap permit 10
match ip address 5
set interface Ethernet4/4
This configuration example shows mobile hosts configured with static IP addresses. Mobile IP policy routing can also be used with dynamically assigned IP addresses. For example, hosts from two different NAI realms can be assigned addresses from the same address pool.
For additional information related to Mobile IP home agent policy routing, refer to the following references:
Mobile IP configuration tasks
"Configuring Mobile IP" chapter in the
Cisco IOS IP Configuration Guide, Release 12.2
Mobile IP commands: complete command syntax, command mode, defaults, usage guidelines, and examples
"Mobile IP Commands" chapter in theCisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services,
Policy routing configuration tasks
"Configuring IP Routing Protocol-Independent Features" chapter in the
Cisco IOS IP Configuration Guide,
To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to email@example.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, tools, and lots more. Registered Cisco.com users can log in from this page to access even more content.
The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the
Cisco IOS IP Mobility Command Reference at http://www.cisco.com/en/US/docs/ios/ipmobility/command/reference/imo_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at
http://tools.cisco.com/Support/CLILookup or to the
Cisco IOS Master Commands List .
homeagent--A router that forwards to mobile node or that tunnels packets to the mobile node or mobile router while they are away from home. It keeps current location information for registered mobile nodes called a mobility binding.
NAI--network access identifier. The user ID submitted by the mobile node during registration to identify the user for authentication. The NAI may help route the registration request to the right Home Agent.