NetFlow Policy Routing

NetFlow policy routing (NPR) integrates policy routing, which enables traffic engineering and traffic classification, with NetFlow services, which provide billing, capacity planning, and information monitoring on real-time traffic flows. IP policy routing works with Cisco Express Forwarding (formerly known as CEF), distributed Cisco Express Forwarding (formerly known as dCEF), and NetFlow.

NetFlow policy routing leverages the following technologies:

• Cisco Express Forwarding, which looks at a Forwarding Information Base (FIB) instead of a routing table when switching packets, to address maintenance problems of a demand caching scheme.
• Distributed Cisco Express Forwarding, which addresses the scalability and maintenance problems of a demand caching scheme.
• NetFlow, which provides accounting, capacity planning, and traffic monitoring capabilities.

The following are the benefits of NPR:

• NPR takes advantage of new switching services. Cisco Express Forwarding, distributed Cisco Express Forwarding, and NetFlow can now use policy routing.
• Policy routing can be deployed on a wide scale and on high-speed interfaces.

NPR is the default policy routing mode. No additional configuration tasks are required to enable policy routing with Cisco Express Forwarding, distributed Cisco Express Forwarding, or NetFlow. As soon as one of these features is turned on, packets are automatically subjected to policy routing in the appropriate switching path.

The following example shows how to configure policy routing with Cisco Express Forwarding. The route is configured to verify that the next hop 10.0.0.8 of the route map named test is a Cisco Discovery Protocol neighbor before the device tries to policy-route to it.

Device(config)# ip cef 
Device(config)# interface GigabitEthernet 0/0/1 
Device(config-if)# ip route-cache flow 
Device(config-if)# ip policy route-map test 
Device(config-if)# exit 
Device(config)# route-map test permit 10 
Device(config-route-map)# match ip address 1 
Device(config-route-map)# set ip precedence priority 
Device(config-route-map)# set ip next-hop 10.0.0.8 
Device(config-route-map)# set ip next-hop verify-availability 
Device(config-route-map)# exit 
Device(config)# route-map test permit 20 
Device(config-route-map)# match ip address 101 
Device(config-route-map)# set interface Ethernet 0/0/3 
Device(config-route-map)# set ip tos max-throughput 
Device(config-route-map)# exit
 

You can use the set ip next-hop verify-availability command to configure policy routing to verify the reachability of the next hop of a route map before the device performs policy routing to that next hop. This command has the following restrictions:

• It can cause performance degradation.
• Cisco Discovery Protocol must be enabled on the interface.
• The directly connected next hop must be a Cisco Discovery Protocol-enabled Cisco device.
• It does not work with distributed Cisco Express Forwarding configurations.

If a device is policy routing packets to the next hop and the next hop happens to be down, the device tries unsuccessfully to use the Address Resolution Protocol (ARP). This behavior can continue indefinitely. You can prevent this behavior by configuring the set ip next-hop verify availability command on the device. This command first verifies (using a route map) whether the next hop is a Cisco Discovery Protocol neighbor of the device before routing packets to that next hop. However, if you configure this command on a device whose next hop is not a Cisco Discovery Protocol neighbor, the device looks at the subsequent next hop, if there is one. If there is no available next hop, packets are not policy-routed. This configuration is optional because some media or encapsulations do not support Cisco Discovery Protocol.

If the set ip next-hop verify availability command is not configured, packets are either policy-routed or remain forever unrouted.

If you want to verify the availability of only some next hops, you can configure different route-map entries (under the same route-map name) with different criteria (using access-list matching or packet-size matching), and use the set ip next-hop verify availability configuration command selectively.