Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

EPBR configuration

Updated: April 24, 2026

Want to summarize with AI?

Log in

Provides the general method for implementation using CLI add-on feature templates within Cisco SD-WAN Manager and configuration examples using ACLs, class maps, and policy maps.

To configure ePBR using Cisco SD-WAN Manager, create a CLI add-on feature template and attach it to the device template.

This section provides examples of ePBR configurations that you can add to the CLI add-on template.

Configure ePBR for IPv4

In the following example:

  • The extended ACLs define the network or the host.

  • Class maps match the parameters in the ACLs.

  • Policy maps with ePBR then take detailed actions based on the set statements configured.

  • Multiple next-hops are configured. ePBR chooses the first available next-hop.


ip access-list extended test300
 100 permit ip any 192.0.2.1 0.0.0.255
ip access-list extended test100
 100 permit ip any 192.0.2.20 0.0.0.255
!
class-map match-any test300
 match access-group name test300
class-map match-any test100
 match access-group name test1
!
policy-map type epbr test300
 class test300
  set ipv4 vrf 300 next-hop 10.0.0.2 10.0.40.1 10.0.50.1 ...
policy-map type epbr test100
 class test100
  set ipv4 vrf 100 next-hop 10.10.0.2 10.20.20.2 10.30.30.2 ...
!
interface GigabitEthernet0/0/1
 service-policy type epbr input test300
interface GigabitEthernet0/0/2
 service-policy type epbr input test100

Configure IPv4 Tracking

This example shows how to configure ePBR along with tracking. In the example:

  • IP SLA operations of type ICMP Echo are configured and ACLs are defined.

  • Class maps are then used to match parameters in the ACLs and the policy map takes action based on the set statements configured.

  • The number 10 in set ipv4 vrf 300 next-hop verify-availability 10.10.0.2 10 track 2 represents the sequence number.


ip sla 1
  icmp-echo 10.0.0.2
  vrf 100
ip sla schedule 1 life forever start-time now
track 1 ip sla 1 state
ip sla 2
  icmp-echo 10.10.0.2
  vrf 300
ip sla schedule 2 life forever start-time now
track 2 ip sla 2 state
ip access-list extended test300
 100 permit ip any 10.10.0.2 0.0.0.255
ip access-list extended test100
 100 permit ip any 10.10.0.3 0.0.0.255
class-map match-any test300
 match access-group name test300
class-map match-any test100
 match access-group name test100
policy-map type epbr test300
 class test300
  set ipv4 vrf 300 next-hop verify-availability 10.10.0.2 10 track 2   
policy-map type epbr test100
 class test100
  set ipv4 vrf 100 next-hop verify-availability 10.0.0.2 10 track 1
!
interface GigabitEthernet0/0/1
 service-policy type epbr input test300
interface GigabitEthernet0/0/2
 service-policy type epbr input test100

Configure ePBR for IPv6

In the following example:

  • The extended ACLs define the network or the host.

  • Class maps are used to match the parameters in the ACLs.

  • Policy maps with ePBR then take detailed actions based on the set statements configured. .

  • Single or multiple next-hop addresses can be configured. ePBR selects the first available next-hop address

ipv6 access-list test300_v6
  sequence 100 permit ipv6 any 2001:DB81::/32  
ipv6 access-list test100_v6
 sequence 100 permit ipv6 any 2001:DB82::/32   
!
class-map match-any test300_v6
 match access-group name test300_v6
class-map match-any test100_v6
 match access-group name test100_v6
policy-map type epbr test300_v6
 class test300_v6
  set ipv6 vrf 300 next-hop 2001:DB8::1 
policy-map type epbr test100_v6
 class test100_v6
  set ipv6 vrf 100 next-hop 2001:DB8::2 2001:DB8:FFFF:2 ... 
!
interface GigabitEthernet0/0/1
 service-policy type epbr input test300_v6
interface GigabitEthernet0/0/2
 service-policy type epbr input test100_v6

Configure IPv6 Tracking

The following example shows how to configure IPv6 tracking with ePBR:

ip sla 1
  icmp-echo 2001:DB8::1
  vrf 100
ip sla schedule 1 life forever start-time now
track 1 ip sla 1 state
ip sla 2
  icmp-echo 2001:DB8::2
  vrf 300
ip sla schedule 2 life forever start-time now
track 2 ip sla 2 state
ip sla 3
  icmp-echo 2001:DB8::3
  vrf 400
ip sla schedule 3 life forever start-time now
track 3 ip sla 3 state
ipv6 access-list test300_v6
 sequence 100 permit ipv6 any 2001:DB81::/32
ipv6 access-list test100_v6
 sequence 100 permit ipv6 any 2001:DB82::/32
!
class-map match-any test300_v6
 match access-group name test300_v6
class-map match-any test100_v6
 match access-group name test100_v6
!
policy-map type epbr test300_v6
 class test300_v6
  set ipv6 vrf 300 next-hop verify-availability 2001:DB8::2 10 track 2
  set ipv6 vrf 400 next-hop verify-availability 2001:DB8::3 11 track 3
policy-map type epbr test100_v6
 class test100_v6
  set ipv6 vrf 100 next-hop verify-availability 2001:DB8::1 10 track 1
!
interface GigabitEthernet0/0/1
 service-policy type epbr input test300_v6
interface GigabitEthernet0/0/2
 service-policy type epbr input test100_v6
!
Note
When next hops are configured along with the tracker, if the next hop is unreachable or if the IP SLA fails, the next available hop is selected. This means that when the tracker is configured, both next hop availability and IP SLA results are checked.