Sample policy for route control

The example describes flows and policies based on the sample topology.

The applications, app1 and app4, can be advertised from US East region and blocked from other regions. Similarly app2 is advertised from US Central, and app3 from US West.

For a remote user in the SSE US East region to access app1, the traffic flows through the SD-WAN tunnels in the US East region to the US East hub routers. To access app2, the traffic travels via the SSE Multi-region Backhaul backbone to the US Central region, passes through the SD-WAN tunnels to the US Central hub routers, and then reaches app2. To access app3, the traffic moves through the SSE Multi-region Backhaul backbone to the US West region, goes through the SD-WAN tunnels to the US West hub routers, and then reaches app3.

The traffic first uses the primary tunnels. If the primary tunnels to one hub router are down, the traffic switches to the primary tunnels of the second hub router. Only when all primary tunnels are down the traffic uses the secondary tunnels.

SSE import policy on SD-WAN hubs

This is an example of a sample route policy configuration.

ip as-path access-list 1 permit _60001_
ip community-list expanded ALL_SSE_COMM permit ^32644:.*
ip community-list expanded DCI_COMM permit ^50001:.*
ip community-list expanded HUB_OMP_COMM permit ^60001:.*

Import Policy for primary tunnel BGP towards SSE on Hub routers:
---------------------------------------------------------------------------------------
route-map IMPORT_SSE_PRIMARY deny 1 
    match as-path 1
route-map IMPORT_SSE_PRIMARY permit 2
    match community ALL_SSE_COMM
route-map IMPORT_SSE_PRIMARY deny 65534 

Import Policy for secondary tunnel BGP towards SSE on Hub routers:
--------------------------------------------------------------------------------------------
route-map IMPORT_SSE_SECONDARY deny 1 
    match as-path 1
route-map IMPORT_SSE_SECONDARY permit 2
    match community ALL_SSE_COMM
    set as-path prepend 32644
route-map IMPORT_SSE_SECONDARY deny 65534 

OMP AS-path on SD-WAN hub routers

The route policy imports SSE prefixes and prepends the AS path based on community and metric. On hub routers, you can convert the AS path length to OMP preference, so that the spoke routers prefer the correct hub router for the reverse path to reach SSE prefixes.

sdwan 
     omp 
          overlay-as       60001 

Service side BGP import route policy on SD-WAN hub routers

On the service side of hub routers with external BGP neighbors, create an import route policy that rejects any prefixes with the SSE community. Core routers on the SD-WAN side can export SSE prefixes to other regions through data center interconnects, which returns to SD-WAN hub routers of other regions via external BGP. This import policy blocks those prefixes from the data center core routers.

route-map IMPORT_CORE deny 1 
         match community ALL_SSE_COMM
route-map IMPORT_CORE deny 2
         match as-path 1
 route-map IMPORT_CORE permit 65534 

Export policy to SSE on SD-WAN hub routers

Create an export route policy toward SSE neighbors that rejects any prefixes with the SSE community. Hub routers learn SSE prefixes through OMP from hub routers of other regions, so you should filter these routes before exporting them to SSE neighbors.

Export Policy for both primary and secondary tunnel BGP towards SSE:  (For HUBs which is not exporting spoke routes to SSE)
---------------------------------------------------------------------------------------------
route-map EXPORT_SSE deny 1 
    match community ALL_SSE_COMM
    match community DCI_COMM
    match community HUB_OMP_COMM
route-map EXPORT_SSE deny 2
    match as-path 1
route-map EXPORT_SSE permit 65534

Export Policy for both primary and secondary tunnel BGP towards SSE: (For HUBs which is exporting spoke routes to SSE)
---------------------------------------------------------------------------------------------
route-map EXPORT_SSE deny 1 
    match community ALL_SSE_COMM
    match community DCI_COMM
    match community HUB_OMP_COMM
route-map EXPORT_SSE permit 65534

OMP export policy on hub routers

Create an export route policy for OMP on hub routers.

For hubs which is exporting spoke routes to SSE
route-map EXPORT_OMP permit 1 
          set community 60001:1
route-map EXPORT_OMP deny 65534

sdwan
   omp
     auto-translate
          as-path-length
          to-route-preference
      !
      address-family ipv4 vrf 1
          advertise bgp route-map EXPORT_OMP
      !

For hubs which is not exporting spoke routes to SSE
route-map EXPORT_OMP deny 1 
          match community ALL_SSE_COMM
route-map EXPORT_OMP permit 2 
          set community 60001:1
route-map EXPORT_OMP deny 65534

sdwan
   omp
      address-family ipv4 vrf 1
          advertise bgp route-map EXPORT_OMP
  !