Downloads |
Table Of Contents
Mobile IP Home Agent Policy Routing
Prerequisites for Mobile IP Home Agent Policy Routing
Information About Mobile IP Home Agent Policy Routing
Feature Design of Mobile IP Home Agent Policy Routing
How to Configure Mobile IP Home Agent Policy Routing
Enabling Policy Routing on the Home Agent
Verifying Policy Routing on the Home Agent
Configuration Examples for Mobile IP Home Agent Policy Routing
Home Agent Policy Routing Example
Mobile IP Home Agent Policy Routing
The Mobile IP Home Agent Policy Routing feature supports route maps on Mobile IP tunnels created at the home agent. This feature allows an Internet Service Provider (ISP) to provide service to multiple customers. While reverse tunneling packets, the home agent looks up where the packet should go. For example, if an address corresponds to a configured network access identifier (NAI) realm name (such as cisco.com), the packet goes out interface 1, which has a connection to the Cisco network. If an address corresponds to another NAI realm name (such as company2.com), the packet goes out interface 2, which has a connection to the Company2 network.
Feature Specifications for Mobile IP Home Agent Policy Routing
12.2(13)T
This feature was introduced.
Refer to Feature Navigator.
Determining Platform Support Through Cisco Feature Navigator
Cisco IOS software is packaged in feature sets that are supported on specific platforms. To get updated information regarding platform support for this feature, access Cisco Feature Navigator. Cisco Feature Navigator dynamically updates the list of supported platforms as new platform support is added for the feature.
Cisco Feature Navigator is a web-based tool that enables you to determine which Cisco IOS software images support a specific set of features and which features are supported in a specific Cisco IOS image. You can search by feature or release. Under the release section, you can compare releases side by side to display both the features unique to each software release and the features in common.
To access Cisco Feature Navigator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:
Cisco Feature Navigator is updated regularly when major Cisco IOS software releases and technology releases occur. For the most current information, go to the Cisco Feature Navigator home page at the following URL:
Availability of Cisco IOS Software Images
Platform support for particular Cisco IOS software releases is dependent on the availability of the software images for those platforms. Software images for some platforms may be deferred, delayed, or changed without prior notice. For updated information about platform support and availability of software images for each Cisco IOS software release, refer to the online release notes or, if supported, Cisco Feature Navigator.
Contents
•
Prerequisites for Mobile IP Home Agent Policy Routing
•
•
•
Prerequisites for Mobile IP Home Agent Policy Routing
Reverse tunnelling must be enabled on both the home agent and foreign agent.
Information About Mobile IP Home Agent Policy Routing
The following sections describe concepts related to Mobile IP home agent policy routing:
•
Policy Routing
Policy routing is a more flexible mechanism for routing packets than destination routing. Policy routing allows network administrators to implement policies that selectively cause packets to take different paths. The policy can be as simple as not allowing any traffic from a department on a network or as complex as making sure traffic with certain characteristics originating within a network takes path A, while other traffic takes path B.
Policy routing is applied to incoming packets. All packets received on an interface with policy routing enabled are considered for policy routing. The router passes the packets through enhanced packet filters called route maps. The route map determines which packets are routed to which router next. Based on the criteria defined in the route maps, packets are forwarded/routed to the appropriate next hop.
Feature Design of Mobile IP Home Agent Policy Routing
The Mobile IP Home Agent Policy Routing feature allows policy routing for mobile nodes based on the NAI configuration. ISPs can use this feature to route traffic originating from different sets of users, as identified by the NAI realm name, through different Internet connections across the policy routers. When the mobile node registers, entries are added dynamically in the access list pointed to by the route map and the route map is applied to the tunnel interface.
A route map is configured and applied on the Mobile IP tunnel. When a packet arrives on a tunnel interface and policy routing is enabled on that tunnel (route map applied), the packet is checked against the access list configured on the route map.
Figure 1 shows a sample topology for home agent policy routing. In Figure 1, as traffic from u1@company1.com and u10@ company2.com is policy routed, the home agent forwards it per the policy instead of routing directly to the destination address.
Figure 1 Sample Topology for Mobile IP Home Agent Policy Routing
How to Configure Mobile IP Home Agent Policy Routing
This section contains the following procedures:
•
•
•
Enabling Policy Routing on the Home Agent
This section describes how to enable policy routing on the home agent:
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
DETAILED STEPS
Defining the Route Map
This section describes how to define the route map and define the criteria by which packets are examined to learn if they will be policy-routed.
Restrictions
The Mobile IP Home Agent Policy Routing feature supports only standard access lists; named and extended access lists are not supported.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Verifying Policy Routing on the Home Agent
To verify the home agent policy routing configuration, use the following commands in privileged EXEC mode, as needed:
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Step 1
enable
Example:Router> enable
Enables higher privilege levels, such as privileged EXEC mode.
•
Step 2
show ip mobile binding
Example:Router# show ip mobile bindingDisplays the mobility binding table.
•
Step 3
show ip mobile tunnel
Example:Router# show ip mobile tunnelDisplays the active tunnels.
•
Step 4
show access-lists
Example:Router# show access-listsDisplays the contents of the current access lists.
•
Step 5
show ip policy
Example:Router# show ip policyDisplays the route map used for policy routing.
•
Step 6
show ip mobile vpn-realm
Example:Router# show ip mobile vpn-realmDisplays the Mobile IP VPN realms and sequence numbers.
•
Output Examples
This section provides the following output examples:
•
•
•
•
•
Sample Output for the show ip mobile binding Command
The following is example output for a mobile host using the NAI realm of u10@company2.com:
Router# show ip mobile bindingMobility Binding List:Total 1u10@company2.com (Bindings 1):Home Addr 65.1.1.10Care-of Addr 4.4.4.3, Src Addr 3.3.3.3Lifetime granted 00:05:00 (300), remaining 00:03:58Flags sBdmgvT, Identification BF7A951C.28FA35ABTunnel1 src 150.150.150.150 dest 4.4.4.3 reverse-allowedRouting Options - (T)Reverse-tunnelSample Output for the show ip mobile tunnel Command
The following example displays the active Mobile IP tunnels and the configured route map:
Router# show ip mobile tunnelTotal mobile ip tunnels 1Tunnel1:src 150.150.150.150, dest 4.4.4.3encap IP/IP, mode reverse-allowed, tunnel-users 1IP MTU 1514 bytesPath MTU Discovery, mtu:0, ager:10 mins, expires:neveroutbound interface Mobile0HA created, fast switching enabled, ICMP unreachable enabled10 packets input, 1000 bytes, 0 drops5 packets output, 600 bytesRoute Map is:moipmapSample Output for the show access-lists Command
The following example displays the access list:
Router# show access-listsStandard IP access list 5permit 65.1.1.10Sample Output for the show ip policy Command
The following example displays the route maps applied to the tunnels:
Router# show ip policyInterface Route mapTunnel0 moipmapTunnel1 moipmapSample Output for the show ip mobile vpn-realm Command
The following examples show two VPN realms configured on the router with the corresponding show output:
ip mobile vpn-realm company1.com route-map-sequence 20ip mobile vpn-realm company2.com route-map-sequence 10Router# show ip mobile vpn-realmIP Mobile VPN realm(s):Sequence number: 20 Realm: company1.comSequence number: 10 Realm: company2.comConfiguration Examples for Mobile IP Home Agent Policy Routing
The following section provides a configuration example:
•
Home Agent Policy Routing Example
In the following example, the route map named moipmap is applied to the Mobile IP tunnel and traffic is routed, based on the NAI VPN realm configuration, through different connections across the policy routers:
!router mobile!ip mobile home-agent address 150.150.150.150 lifetime 65535 replay 255ip mobile vpn-realm company2.com route-map-sequence 10ip mobile virtual-network 65.0.0.0 255.0.0.0ip mobile host nai u10@company2.com address 65.1.1.10 virtual-network 65.0.0.0 255.0.0.0ip mobile host nai u9@company2.com address 65.1.1.9 virtual-network 65.0.0.0 255.0.0.0ip mobile host nai u2@company1.com address 65.1.1.2 virtual-network 65.0.0.0 255.0.0.0ip mobile host nai u1@company1.com address 65.1.1.1 virtual-network 65.0.0.0 255.0.0.0ip mobile secure host nai u2@company1.com spi 100 key hex 12345678123456781234567812345678ip mobile secure host nai u1@company1.com spi 100 key hex 45678123451234567812367812345678ip mobile secure host nai u9@company2.com spi 100 key hex 81234567812345678123456712345678ip mobile secure host nai u10@company2.com spi 100 key hex 23456781234567812345678123456781ip mobile tunnel route-map moipmap!access-list 5 permit 65.1.1.10!route-map moipmap permit 10match ip address 5set interface Ethernet4/4!
Note
Additional References
For additional information related to Mobile IP home agent policy routing, refer to the following references:
•
•
Related Documents
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
http://tools.cisco.com/ITDIT/MIBS/servlet/index
If Cisco MIB Locator does not support the MIB information that you need, you can also obtain a list of supported MIBs and download MIBs from the Cisco MIBs page at the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:
RFCs
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
—
Technical Assistance
Command Reference
This section documents new and modified commands. All other commands used with this feature are documented in the Cisco IOS Release 12.2 command reference publications.
ip mobile tunnel
To specify the settings of tunnels created by Mobile IP, use the ip mobile tunnel command in global configuration mode. To disable the setting of tunnels created by Mobile IP, use the no form of this command.
ip mobile tunnel {route-cache | path-mtu-discovery [age-timer {minutes | infinite}] |
nat {inside | outside} | route-map map-tag}no ip mobile tunnel {route-cache | path-mtu-discovery [age-timer {minutes | infinite}] |
nat {inside | outside} | route-map map-tag}Syntax DescriptionI
Defaults
Disabled.
If enabled, default value for the minutes argument is 10 minutes.
Command Modes
Global configuration
Command History
Usage Guidelines
Path MTU Discovery is used by end stations to find a packet size that does not need fragmentation between them. Tunnels must adjust their MTU to the smallest MTU interior to achieve this condition, as described in RFC 2003.
The discovered tunnel MTU should be aged out periodically to possibly recover from a case where suboptimum MTU existed at time of discovery. It is reset to the outgoing MTU of the interface.
Examples
The following example sets the discovered tunnel MTU to expire in 10 minutes (600 seconds):
ip mobile tunnel path-mtu-discovery age-timer 600Related Commands
ip mobile vpn-realm
To define the VPN realms to be used in home agent policy routing, use the ip mobile vpn-realm command in global configuration mode. To remove the VPN realms, use the no form of this command.
ip mobile vpn-realm realm-name {route-map-sequence sequence-number}
no ip mobile vpn-realm realm-name {route-map-sequence sequence-number}
Syntax Description
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
The sequence-number argument must match that configured in the route-map sequence-number command.
Examples
The following example shows two realms configured on the router:
ip mobile vpn-realm company1.com route-map-sequence 20ip mobile vpn-realm company2.com route-map-sequence 10Related Commands
route map
Defines the conditions for redistributing routes from one routing protocol into another, or to enable policy routing.
Displays VPN realms configured for Mobile IP.
show ip mobile tunnel
To display active tunnels, use the show ip mobile tunnel EXEC command.
show ip mobile tunnel [interface]
Syntax Description
Command Modes
EXEC
Command History
12.0(1)T
This command was introduced.
12.2(13)T
The output was enhanced to display route maps configured on the home agent.
Usage Guidelines
This command displays active tunnels created by Mobile IP. When no more users are on the tunnel, the tunnel is released.
Examples
The following is sample output from the show ip mobile tunnel command:
Router# show ip mobile tunnelMobile Tunnels:Tunnel0:src 68.0.0.32, dest 68.0.0.48encap IP/IP, mode reverse-allowed, tunnel-users 1IP MTU 1480 bytesHA created, fast switching enabled, ICMP unreachable enabled0 packets input, 0 bytes, 0 drops1591241 packets output, 1209738478 bytesRoute Map is: MoIPMapTable 1 describes the significant fields shown in the display.
Related Commands
show ip mobile vpn-realm
To display VPN realms configured for Mobile IP, use the show ip mobile vpn-realm command in EXEC mode.
show ip mobile vpn-realm
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
EXEC
Command History
Usage Guidelines
Use this command to display VPN realms configured by the ip mobile vpn-realm command.
Examples
The following example output shows which VPN realms and corresponding sequence numbers are configured for Mobile IP:
Router# show ip mobile vpn-realmIP Mobile VPN realm(s):Sequence number: 20 Realm: company1Sequence number: 10 Realm: company2Related Commands
Glossary
home agent—A router that forwards to mobile node or that tunnels packets to the mobile node or mobile router while they are away from home. It keeps current location information for registered mobile nodes called a mobility binding.
NAI—network access identifier. The user ID submitted by the mobile node during registration to identify the user for authentication. The NAI may help route the registration request to the right Home Agent.
Note
