Managing Network Traffic with Protocol-Based Routing

.

Efficient HTTP Traffic Routing Using Cisco Policy-Based Routing

Efficient routing is critical in modern networks. In scenarios where specific traffic (such as HTTP on TCP port 80) must follow a designated path, Policy-Based Routing (PBR) provides granular control beyond traditional routing tables.

---

🎯 Learning Objective

Redirect HTTP traffic for specific source addresses to a defined next-hop IP, while routing all other traffic via a default path.

💡 Key Takeaway: Policy-Based Routing allows routing decisions based on traffic characteristics — not just destination.

---

📘 Configuration Walkthrough

Step 1 – Create the Access Control List (ACL)

The ACL identifies HTTP traffic and filters it based on source subnet.

Router(config)#access-list 101 deny tcp 10.15.25.0 0.0.0.255 any eq www
Router(config)#access-list 101 permit tcp any any eq www

Explanation

• Deny: Blocks HTTP traffic from 10.15.25.0/24 from matching PBR.
• Permit: Allows other HTTP traffic to match the route-map.

💡 ACLs in PBR define traffic to match — not to block.

---

Step 2 – Apply Policy to Interface

Attach the route-map to the ingress interface.

Router(config)#interface Ethernet0
Router(config-if)#ip address 10.15.22.7 255.255.255.0
Router(config-if)#ip policy route-map Websurfers
Router(config-if)#ip route-cache policy
Router(config-if)#exit

Command Breakdown

• ip policy route-map → Activates PBR on interface.
• ip route-cache policy → Enables caching for improved performance.

💡 PBR works on inbound traffic of the configured interface.

---

Step 3 – Define Route Map (Traffic Redirection Logic)

Primary Route (Matched HTTP Traffic)

Router(config)#route-map Websurfers permit 10
Router(config-route-map)#match ip address 101
Router(config-route-map)#set ip next-hop 10.15.27.1
Router(config-route-map)#exit

Traffic matching ACL 101 will be redirected to next-hop 10.15.27.1.

Default Route for Other Traffic

Router(config)#route-map Websurfers permit 20
Router(config-route-map)#set ip default next-hop 10.15.26.1
Router(config-route-map)#end

All unmatched traffic follows next-hop 10.15.26.1.

💡 Route-map sequence numbers determine processing order.

---

⚙ Key Configuration Considerations

IOS Version Differences

• Syntax may vary slightly between IOS versions.
• Enhanced ACL capabilities may be available in newer releases.
• Advanced PBR options (tracking, multiple next-hops, etc.) may exist.

Performance Optimization

• Enable policy route caching where supported.
• Monitor CPU utilization in high-throughput environments.
• Newer IOS versions improve packet handling efficiency.

💡 Always validate configuration compatibility with your IOS version before deployment.

---

📈 Practical Use Cases

1️⃣ Traffic Segmentation

Redirect HTTP traffic through monitoring or security appliances.

2️⃣ Load Balancing

Distribute traffic across multiple next-hop paths.

3️⃣ Policy Enforcement

Ensure compliance with internal routing and security policies.

---

📌 Summary

Using Access Lists, Route Maps, and Policy-Based Routing, administrators can route traffic based on TCP/UDP port numbers or source criteria.

💡 PBR extends routing control beyond traditional destination-based routing.

---

🧪 Suggested Lab Exercise

1. Configure ACL 101 and verify with show access-lists
2. Apply route-map and validate with show route-map
3. Test HTTP traffic and verify next-hop routing
4. Use debug ip policy for troubleshooting

---

End of Interactive Educational Guide

Policy-Based Routing: Configuration Changes and Enhancements Over Time

Policy-Based Routing (PBR) Configuration Evolution in Cisco IOS

Policy-Based Routing (PBR) has long been one of the most powerful traffic engineering tools available in Cisco networking environments. Traditional routing decisions rely exclusively on the destination IP address found in the routing table. PBR fundamentally changes this behavior by allowing administrators to make forwarding decisions based on additional criteria such as:

• Source IP address
• Application type
• Packet size
• QoS markings
• Protocols
• DSCP values
• Time-based conditions

This flexibility enables highly customized traffic flows that would otherwise be impossible using conventional routing alone.

Key Idea: PBR overrides the routing table and gives administrators manual control over packet forwarding decisions.

---

📚 Table of Contents

• What is Policy-Based Routing?
• How Traditional Routing Works
• Why PBR is Important
• PBR Workflow Explained
• ACL Evolution in Cisco IOS
• Understanding Route Maps
• Applying PBR to Interfaces
• Verification and Troubleshooting
• VRF Integration
• IPv6 Policy-Based Routing
• Advanced PBR Features
• Performance Considerations
• Best Practices
• Conclusion
• Related Articles

---

🔍 What is Policy-Based Routing?

Policy-Based Routing allows network administrators to create customized forwarding rules independent of the routing table.

Normally, routers perform destination-based routing using the formula:

\\[ Routing\ Decision = f(Destination\ IP) \\]

With PBR, routing decisions become:

\\[ Routing\ Decision = f(Source,\ Protocol,\ QoS,\ Application,\ Policy) \\]

This means administrators gain granular control over how packets traverse the network.

📖 Real-World Example

Imagine a company with two internet connections:

• Engineering department traffic should use ISP-A
• Marketing traffic should use ISP-B
• VoIP traffic should always use the low-latency WAN link

Traditional routing cannot easily achieve this because both departments may access the same destinations. PBR solves this elegantly.

---

🌐 How Traditional Routing Works

Before understanding PBR deeply, it is important to understand standard IP routing.

Routers examine:

• Destination IP address
• Routing table entries
• Longest prefix match

The router then selects the best path.

Mathematically:

\\[ Best\ Route = Longest\ Prefix\ Match \\]

Example routing table:

Network	Next Hop
10.0.0.0/8	192.168.1.1
10.15.0.0/16	192.168.2.1

Traffic to 10.15.10.5 matches both routes, but the /16 route wins because it is more specific.

---

🎯 Why Policy-Based Routing is Important

Modern enterprise networks are far more complex than older static infrastructures.

Organizations now require:

• Traffic engineering
• Application-aware routing
• WAN optimization
• Cloud integration
• Multi-ISP routing
• Security segmentation
• Load balancing

PBR helps accomplish these goals.

Important: PBR is not a replacement for routing protocols like OSPF or BGP. Instead, it complements them by adding policy intelligence.

---

⚙️ PBR Workflow Explained

The typical PBR process follows four stages:

1. Traffic classification using ACLs
2. Policy creation using route-maps
3. Policy actions defined
4. Policy applied to interface

Traffic Matching Logic

Packets are evaluated according to:

\\[ If\ Match(Packet)\rightarrow Apply\ Policy \\]

Otherwise:

\\[ Use\ Normal\ Routing \\]

---

📘 ACL Evolution in Cisco IOS

Access Control Lists (ACLs) are essential for PBR because they identify traffic that should receive special routing treatment.

Earlier IOS Syntax

access-list 1 permit 10.15.35.0 0.0.0.255
access-list 2 permit 10.15.36.0 0.0.0.255

Modern Named ACL Syntax

ip access-list standard ENGINEER-TRAFFIC
 permit 10.15.35.0 0.0.0.255

ip access-list standard MARKETING-TRAFFIC
 permit 10.15.36.0 0.0.0.255

📖 Why Named ACLs are Better

• Easier troubleshooting
• More readable configurations
• Simplified maintenance
• Reduced human error
• Better documentation

---

🛣 Understanding Route Maps

Route maps are the core engine of PBR.

A route-map contains:

• Match statements
• Set actions
• Sequence numbers

Earlier Route Map Example

route-map Engineers permit 10
 match ip address 1
 set ip next-hop 10.15.27.1

route-map Engineers permit 20
 match ip address 2
 set interface Ethernet1

Modern Route Map Example

route-map ENGINEER-ROUTE permit 10
 match ip address ENGINEER-TRAFFIC
 set ip next-hop 10.15.27.1

route-map ENGINEER-ROUTE permit 20
 match ip address MARKETING-TRAFFIC
 set interface Ethernet1

Mathematical Representation of Route Matching

Policy evaluation can be represented as:

\\[ Policy = Match\ Condition + Action \\]

Or:

\\[ If\ ACL = TRUE,\ then\ Set\ NextHop \\]

---

🔌 Applying PBR to Interfaces

The policy must be attached inbound to an interface.

interface Ethernet0
 ip address 10.15.22.7 255.255.255.0
 ip policy route-map ENGINEER-ROUTE

Important concept:

PBR works on inbound packets entering the interface.

📖 Why Inbound?

The router evaluates the policy immediately after receiving the packet, before normal routing lookup occurs.

---

🧪 Verification and Troubleshooting

Modern IOS versions provide excellent visibility tools.

Verification Commands

show ip policy
show route-map
show access-lists
show ip interface

CLI Output Example

Router# show ip policy

Interface      Route map
Ethernet0      ENGINEER-ROUTE

Debugging Commands

debug ip policy

Debug Output Example

IP: s=10.15.35.10 (Ethernet0), d=8.8.8.8
FIB policy match
route map ENGINEER-ROUTE, item 10
set ip next-hop 10.15.27.1

---

🏢 VRF Integration

Virtual Routing and Forwarding (VRF) enables multiple routing tables on the same router.

Modern PBR integrates seamlessly with VRFs.

route-map VRF-POLICY permit 10
 match ip address VRF-TRAFFIC
 set ip next-hop 192.168.1.1

interface Ethernet1
 ip vrf forwarding CUSTOMER-A
 ip policy route-map VRF-POLICY

This is especially useful for:

• MPLS VPNs
• Managed services
• Customer segmentation
• Cloud multi-tenancy

---

🌍 IPv6 Policy-Based Routing

Modern IOS fully supports IPv6 PBR.

ipv6 access-list IPV6-PBR
 permit ipv6 2001:db8:1::/64 any

route-map IPV6-POLICY permit 10
 match ipv6 address IPV6-PBR
 set ipv6 next-hop 2001:db8:100::1

This is essential because IPv6 adoption continues to grow globally.

---

🚀 Advanced PBR Features

DSCP-Based Routing

route-map VOICE-POLICY permit 10
 match ip dscp ef
 set ip next-hop 10.10.10.1

Load Sharing

PBR can distribute traffic across multiple paths:

\\[ Traffic\ Distribution = \frac{Flow_1 + Flow_2}{Available\ Links} \\]

Application Routing

Modern IOS can integrate with NBAR for application-aware routing decisions.

---

📈 Performance Considerations

Although PBR is powerful, it introduces CPU overhead because packets must be evaluated against policies.

Important Performance Factors

• ACL complexity
• Route-map size
• Traffic volume
• Hardware acceleration support

Approximate processing relationship:

\\[ CPU\ Usage \propto Number\ of\ Policy\ Evaluations \\]

---

✅ Best Practices

• Use named ACLs
• Document policies carefully
• Minimize unnecessary matches
• Test policies before production deployment
• Use sequence numbering properly
• Monitor CPU utilization
• Always verify fallback routing behavior

Pro Tip: Always include a normal routing fallback path in case PBR next-hops become unreachable.

---

📌 Conclusion

Policy-Based Routing continues to be one of the most flexible and valuable tools in Cisco networking.

While the foundational principles remain unchanged, modern IOS releases have significantly improved:

• Configuration readability
• Troubleshooting visibility
• IPv6 support
• VRF integration
• Advanced traffic matching
• Operational scalability

Understanding both older and modern approaches is extremely important for network engineers working across legacy and contemporary infrastructures.

As enterprise networks continue evolving toward cloud-first and application-aware architectures, PBR remains highly relevant for intelligent traffic engineering.

---

📚 Final Key Takeaways

• PBR overrides normal routing decisions
• ACLs classify traffic
• Route maps define policies
• Policies are applied inbound on interfaces
• Modern IOS introduces improved scalability and readability
• IPv6 and VRF support make PBR future-ready
• Troubleshooting tools significantly improve operational efficiency