Mobile IP Home Agent Policy Routing

Policy routing is a more flexible mechanism for routing packets than destination routing. Policy routing allows network administrators to implement policies that selectively cause packets to take different paths. The policy can be as simple as not allowing any traffic from a department on a network or as complex as making sure traffic with certain characteristics originating within a network takes path A, while other traffic takes path B.

Policy routing is applied to incoming packets. All packets received on an interface with policy routing enabled are considered for policy routing. The router passes the packets through enhanced packet filters called route maps. The route map determines which packets are routed to which router next. Based on the criteria defined in the route maps, packets are forwarded/routed to the appropriate next hop.

The Mobile IP Home Agent Policy Routing feature allows policy routing for mobile nodes based on the NAI configuration. ISPs can use this feature to route traffic originating from different sets of users, as identified by the NAI realm name, through different Internet connections across the policy routers. When the mobile node registers, entries are added dynamically in the access list pointed to by the route map and the route map is applied to the tunnel interface.

A route map is configured and applied on the Mobile IP tunnel. When a packet arrives on a tunnel interface and policy routing is enabled on that tunnel (route map applied), the packet is checked against the access list configured on the route map.

The figure below shows a sample topology for home agent policy routing. In the figure, as traffic from u1@company1.com and u10@ company2.com is policy routed, the home agent forwards it per the policy instead of routing directly to the destination address.

SUMMARY STEPS

1.    enable

2.    configure {terminal | memory | network}

3.    router mobile

4.    exit

5.    ip mobile home-agent [address ip-address]

6.    ip mobile tunnel route-map map-tag

7.    ip mobile vpn-realm realm-name route-map-sequence sequence-number

8.    ip mobile virtual-network addr mask

9.    ip mobile host nai string

10.    ip mobile secure host nai string spi spi key hex string

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables higher privilege levels, such as privileged EXEC mode. Enter your password if prompted.
Step 2	configure {terminal | memory | network} Example: Router# configure terminal	Enters global configuration mode.
Step 3	router mobile Example: Router(config)# router mobile	Enables Mobile IP on the router.
Step 4	exit Example: Router(config-router)# exit	Returns to global configuration mode.
Step 5	ip mobile home-agent [address ip-address] Example: Router(config)# ip mobile home-agent	Enables and controls home agent services on the router.
Step 6	ip mobile tunnel route-map map-tag Example: Router(config)# ip mobile tunnel route-map moipmap	Applies the route map to the tunnel. The map-tag argument must match that specified in the route-map map-tag command.
Step 7	ip mobile vpn-realm realm-name route-map-sequence sequence-number Example: Router(config)# ip mobile vpn-realm corp.com route-map-sequence 20	Defines the VPN realms to be used in home agent policy routing. The sequence-number argument must match that configured in the route-map sequence-number command. The allowed sequence number range is from 0-65535.
Step 8	ip mobile virtual-network addr mask Example: Router(config)# ip mobile virtual-network 10.2.0.0 255.255.0.0	Inserts a virtual network for mobile nodes in the routing table. This command allows the mobile nodes to use the virtual network as their home network.
Step 9	ip mobile host nai string Example: Router(config)# ip mobile host nai corp.com	Configures a mobile host, which is identified by the NAI.
Step 10	ip mobile secure host nai string spi spi key hex string Example: Router(config)# ip mobile secure host nai corp.com spi 100 key hex 12345678123456781234567812345678	Specifies the mobility security associations for the mobile host.

SUMMARY STEPS

1.    enable

2.    configure {terminal | memory | network}

3.    route-map map-tag [permit | deny][sequence-number]

4.    match ip address access-list-number

5.    set interface [type number]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables higher privilege levels, such as privileged EXEC mode. Enter your password if prompted.
Step 2	configure {terminal | memory | network} Example: Router# configure terminal	Enters global configuration mode.
Step 3	route-map map-tag [permit | deny][sequence-number] Example: Router(config)# route-map moipmap permit 20	Enables policy routing and enters route-map configuration mode. The map-tag argument must match that specified in the ip mobile tunnel route-map map-tag command.
Step 4	match ip address access-list-number Example: Router(config-route-map)# match ip address 5	Performs policy routing on the packets. In the example, access list 5 will be routed to the interface specified by the set interface command.
Step 5	set interface [type number] Example: Router(config-route-map)# set interface ethernet 0	Indicates where to output packets that pass a match clause of route map for policy routing.

SUMMARY STEPS

1.    enable

2.    show ip mobile binding

3.    show ip mobile tunnel

4.    show access-lists

5.    show ip policy

6.    show ip mobile vpn-realm

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables higher privilege levels, such as privileged EXEC mode. Enter your password if prompted.
Step 2	show ip mobile binding Example: Router# show ip mobile binding	Displays the mobility binding table. See the display output in the Output Examples section.
Step 3	show ip mobile tunnel Example: Router# show ip mobile tunnel	Displays the active tunnels. See the display output in the Output Examples section.
Step 4	show access-lists Example: Router# show access-lists	Displays the contents of the current access lists. See the display output in the Output Examples section.
Step 5	show ip policy Example: Router# show ip policy	Displays the route map used for policy routing. The route maps applied to the tunnels are displayed. See the display output in the Output Examples section.
Step 6	show ip mobile vpn-realm Example: Router# show ip mobile vpn-realm	Displays the Mobile IP VPN realms and sequence numbers. See the display output in the Output Examples section.

• Output Examples

Router# show ip mobile binding
Mobility Binding List:
Total 1
u10@company2.com (Bindings 1):
    Home Addr 65.1.1.10
    Care-of Addr 4.4.4.3, Src Addr 3.3.3.3
    Lifetime granted 00:05:00 (300), remaining 00:03:58
    Flags sBdmgvT, Identification BF7A951C.28FA35AB
    Tunnel1 src 150.150.150.150 dest 4.4.4.3 reverse-allowed
    Routing Options - (T)Reverse-tunnel

Router# show ip mobile tunnel
Total mobile ip tunnels 1
Tunnel1:
    src 150.150.150.150, dest 4.4.4.3
    encap IP/IP, mode reverse-allowed, tunnel-users 1
    IP MTU 1514 bytes
    Path MTU Discovery, mtu:0, ager:10 mins, expires:never
    outbound interface Mobile0
    HA created, fast switching enabled, ICMP unreachable enabled
    10 packets input, 1000 bytes, 0 drops
    5 packets output, 600 bytes
    Route Map is:moipmap

Router# show access-lists
Standard IP access list 5
    permit 65.1.1.10

Router# show ip policy
Interface      Route map
Tunnel0        moipmap
Tunnel1        moipmap

ip mobile vpn-realm company1.com route-map-sequence 20
ip mobile vpn-realm company2.com route-map-sequence 10
Router# show ip mobile vpn-realm
IP Mobile VPN realm(s):
    Sequence number: 20      Realm: company1.com
    Sequence number: 10      Realm: company2.com

In the following example, the route map named moipmap is applied to the Mobile IP tunnel and traffic is routed, based on the NAI VPN realm configuration, through different connections across the policy routers:

!
router mobile
!
ip mobile home-agent address 150.150.150.150 lifetime 65535 replay 255
ip mobile vpn-realm company2.com route-map-sequence 10
ip mobile virtual-network 65.0.0.0 255.0.0.0
ip mobile host nai u10@company2.com address 65.1.1.10 virtual-network 65.0.0.0 255.0.0.0
ip mobile host nai u9@company2.com address 65.1.1.9 virtual-network 65.0.0.0 255.0.0.0
ip mobile host nai u2@company1.com address 65.1.1.2 virtual-network 65.0.0.0 255.0.0.0
ip mobile host nai u1@company1.com address 65.1.1.1 virtual-network 65.0.0.0 255.0.0.0
ip mobile secure host nai u2@company1.com spi 100 key hex 12345678123456781234567812345678
ip mobile secure host nai u1@company1.com spi 100 key hex 45678123451234567812367812345678
ip mobile secure host nai u9@company2.com spi 100 key hex 81234567812345678123456712345678
ip mobile secure host nai u10@company2.com spi 100 key hex 23456781234567812345678123456781
ip mobile tunnel route-map moipmap
!
access-list 5 permit 65.1.1.10
!
route-map moipmap permit 10
 match ip address 5
 set interface Ethernet4/4
!

Note	This configuration example shows mobile hosts configured with static IP addresses. Mobile IP policy routing can also be used with dynamically assigned IP addresses. For example, hosts from two different NAI realms can be assigned addresses from the same address pool.