Routing Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

ePBR drop and transmit actions

Updated: June 30, 2026

Want to summarize with AI?

Log in

Describes how enhanced policy-based routing introduces drop and transmit actions to control packet handling precisely, improving security and simplifying policy design.

ePBR drop and transmit actions is a routing feature that

  • provides granular control over how packets matching specific criteria in a PBR policy are handled

  • discards unwanted or malicious traffic directly at the interface to improve security and filtering

  • transmits selected traffic, bypassing PBR rules and following the standard routing table lookup, and

  • simplifies policy design and improves operational clarity with dedicated actions for common traffic management needs.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

ePBR drop and transmit actions

Release 25.4.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100])(select variants only*)

*This feature is supported on Cisco 8711-48Z-M routers.

ePBR drop and transmit actions

Release 25.3.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100], 8010 [ASIC: A100]); Modular Systems (8800 [LC ASIC: P100])

The feature adds two critical forwarding actions, such as drop and transmit to enhanced Policy-Based Routing (ePBR) policies, giving network administrators precise control over how traffic matching specific criteria in a PBR policy is handled. These actions simplify policy creation, remove complex workarounds, and allow administrators to manage exceptions or security scenarios with granular per-traffic control.

CLI:

Drop and transmit actions for enhanced PBR control

The feature enhances ePBR by introducing two new forwarding actions, such as drop and transmit. These actions give network administrators explicit control over the final disposition of traffic matching specific PBR criteria.

Drop action: Discards unwanted or malicious traffic directly at the ingress interface, such as malicious traffic flows, unauthorized protocols, or unwanted sources directly at the ingress interface. This early filtering removes the need for complex ACL configurations, and prevents harmful traffic from consuming network resources.

Transmit action: Forwards selected traffic normally, bypassing PBR-specific next-hop or policy redirection rules, and follows the standard FIB lookup. This ensures that the packet follows the standard routing table lookup and is treated like regular traffic.

These actions complement the existing redirect and set forward-class actions, providing more comprehensive and flexible traffic steering capabilities. By making these actions explicit within ePBR policies, network administrators avoid relying on implicit defaults, complex null interface configurations, or intricate policy ordering.

This capability delivers precise per-traffic handling, strengthens network security, preserves service integrity for critical flows, clarifies operational intent, reduces configuration errors, and streamlines policy design.

Benefits of ePBR drop and transmit actions

ePBR drop and transmit actions offer these benefits:

  • Ensures granular security and filtering for precise traffic handling decisions.

  • Enhances network security by dropping malicious or irrelevant packets early.

  • Flexible exception handling through the transmit option.

  • Simplifies ePBR policies.

Enable drop or transmit actions for PBR policies

Follow these steps to enable drop or transmit actions for PBR policies.

Procedure

1.

Run the class-map type command to define class maps for the traffic you want to control.

Class maps define the match criteria for the PBR policy.

Example:

/* Configure class map to drop traffic */
Router(config)#class-map type traffic match-all UNWANTED-SOURCE-TRAFFIC
Router(config-cmap)#match source-address ipv4 192.168.1.0/24
Router(config-cmap)#end-class-map

/* Configure class map to transmit traffic */
Router(config)#class-map type traffic match-all MANAGEMENT-TRAFFIC
Router(config-cmap)#match destination-port 22
Router(config-cmap)#match destination-port 23
Router(config-cmap)#end-class-map
2.

Run the policy-map type command to create a policy map of type PBR, and assign the new actions to the defined classes.

Example:

Router(config)#
policy-map type pbr INGRESS-SECURITY-POLICY
/* Assign the drop action to the UNWANTED-SOURCE-TRAFFIC class */
Router(config-pmap)#class type traffic UNWANTED-SOURCE-TRAFFIC
Router(config-pmap-c)#drop
Router(config-pmap-c)#exit

/* Assign the transmit action to the MANAGEMENT-TRAFFIC class */
Router(config-pmap)#class type traffic MANAGEMENT-TRAFFIC
Router(config-pmap-c)#transmit
Router(config-pmap-c)#exit
3.

(Optional) Run the class type command to define a class default action when no other class matches.

You can define a default action when traffic does not match any class, and it then follows normal routing.

Example:


Router(config-pmap)#class type traffic class-default
Router(config-pmap-c)#transmit
Router(config-pmap-c)#commit
Router(config-pmap)#end-policy-map
4.

Apply the defined policy map to the required interface.

Example:

Router(config)#interface HundredGigE 0/0/0/1
Router(config-if)#service-policy type pbr input INGRESS-SECURITY-POLICY
Router(config-if)#commit
Router(config-if)#exit
5.

Run the show running-config command to verify the configuration.

Example:

class-map type traffic match-all UNWANTED-SOURCE-TRAFFIC
 match source-address ipv4 192.168.1.0/24
end-class-map
class-map type traffic match-all MANAGEMENT-TRAFFIC
 match destination-port 22
 match destination-port 23
end-class-map
!
policy-map type pbr INGRESS-SECURITY-POLICY
 class type traffic UNWANTED-SOURCE-TRAFFIC
  drop
 !
 class type traffic MANAGEMENT-TRAFFIC
  transmit
 !
 class type traffic class-default
  transmit
 !
end-policy-map
!
interface HundredGigE 0/0/0/1
 service-policy type pbr input INGRESS-SECURITY-POLICY
!
6.

Run the show controllers npu stats command to verify the dropped packets.

Example:

In the sample output, the number of packets dropped is 9000.

Router#show controllers npu stats traps-all instance all location all | exclude "0                    0"
Tue Apr 15 19:44:11.681 PDT
…
Trap Type                                     NPU  Trap  Punt       Punt  Punt  Punt Configured Hardware   Policer Avg-Pkt Packets              Packets
                                              ID   ID    Dest       VoQ   VLAN  TC  Rate(pps)  Rate(pps)  Level   Size    Accepted             Dropped
====================================================================================================================================================================
ONLINE_DIAG                                   0    32   RPLC_CPU    295   1538  7    8038660    8087158    IFG     64      362                  0                   
                        
                            L3_ACL_DROP(D) 
                         
                                                       0    106  NPU_DROP    ---   ---   ---  ---------- ---------- ---     N/A     0                    
                        
                            9000  
                         
ISIS/L3                                       0    133  RPLC_CPU    295   1538  7    10000      9789       IFG     1520    14                   0