Cisco Nexus 9000 Series NX-OS Unicast Routing Configuration Guide, Release 6.x

Policy Route Maps

Each entry in a route map contains a combination of match and set statements. The match statements define the criteria for whether appropriate packets meet the particular policy (that is, the conditions to be met). The set clauses explain how the packets should be routed once they have met the match criteria.

You can mark the route-map statements as permit or deny. You can interpret the statements as follows:

• If the statement is marked as permit and the packets meet the match criteria, the set clause is applied. One of these actions involves choosing the next hop.
• If a statement is marked as deny, the packets that meet the match criteria are sent back through the normal forwarding channels, and destination-based routing is performed.
• If the statement is marked as permit and the packets do not match any route-map statements, the packets are sent back through the normal forwarding channels, and destination-based routing is performed.

Note Policy-based routing is specified on the interface that receives the packets, not on the interface from which the packets are sent.

Set Criteria for Policy-Based Routing

The Cisco Nexus 9000 Series switches support the following set commands for route maps used in policy-based routing:

• set {ip | ipv6} next-hop address1 [address2...] [load-share]
• set interface null0

These set commands are mutually exclusive within the route-map sequence.

In the first command, the IP address specifies the adjacent next-hop router in the path toward the destination to which the packets should be forwarded. The first IP address associated with a currently up connected interface is used to route the packets.

Note You can optionally configure this command for next-hop addresses to load balance traffic for up to 32 IP addresses. In this case, Cisco NX-OS sends all traffic for each IP flow to a particular IP next-hop address.

If the packets do not meet any of the defined match criteria, those packets are routed through the normal destination-based routing process.

Route-Map Processing Logic

When a packet is received on an interface that is configured with a route map, the forwarding logic processes each route-map statement according to the sequence number.

If the route-map statement encountered is a route-map...permit statement, the packet is matched against the criteria in the match command. This command may refer to an ACL that has one or more access control entries (ACEs). If the packet matches the permit ACEs in the ACL, the policy-based routing logic executes the action specified by the set command on the packet.

If the route-map statement encountered is a route-map... deny statement, the packet is matched against the criteria in the match command. This command may refer to an ACL that has one or more ACEs. If the packet matches the permit ACEs in the ACL, policy-based routing processing terminates, and the packet is routed using the default IP routing table.

Note The set command has no effect inside a route-map... deny statement.

• If the route-map configuration does not contain a match statement, the policy-based routing logic executes the action specified by the set command on the packet. All packets are routed using policy-based routing.
• If the route-map configuration references a match statement but the match statement references a non-existing ACL or an existing ACL without any access control entries (ACEs), the packet is routed using the default routing table.
• If the next-hop specified in the set {ip | ipv6} next-hop command is down, is not reachable, or is removed, the packet is routed using the default routing table.

Policy-Based Routing Filtering Options

You can identify traffic by using additional options. The following list includes most but not all additional filtering options.

Policy-based routing ACLs support the following additional filtering options:

• Layer 3 source and/or destination address
• TCP and UDP ports
• Precedence level
• Differentiated Services Code Point (DSCP) value
• TCP packets with the ACK, FIN, PSH, RST, SYN, or URG bit set
• Established TCP connections
• Packet length

Enabling the Policy-Based Routing Feature

You must enable the policy-based routing feature before you can configure a route policy.

SUMMARY STEPS

1. configure terminal

2. [no] feature pbr

3. (Optional) show feature

4. (Optional) copy running-config startup-config

DETAILED STEPS

Configuring a Route Policy

You can use route maps in policy-based routing to assign routing policies to the inbound interface. Cisco NX-OS routes the packets as soon as it finds a next hop and an interface.

BEFORE YOU BEGIN

You must configure the IPv6 RACL TCAM region (using TCAM carving) before you apply the policy-based routing policy for IPv6 traffic. For instructions, see the “Configuring ACL TCAM Region Sizes” and “Configuring TCAM Carving - For Cisco NX-OS Release 6.1(2)I2(1) and Later Releases” sections in the Cisco Nexus 9000 Series NX-OS Security Configuration Guide.

Note The switch has an IPv4 RACL TCAM region by default for IPv4 traffic.

SUMMARY STEPS

1. configure terminal

2. interface type slot/port

3. {ip | ipv6} policy route-map map-name

4. route-map map-name [permit | deny] [seq]

5. match {ip | ipv6} address access-list-name name [name...]

6. (Optional) set ip next-hop address1 [address2...] [load-share]

7. (Optional) set ipv6 next-hop address1 [address2...] [load-share]

8. (Optional) set interface null0

9. (Optional) copy running-config startup-config

DETAILED STEPS