## Overview Policy-Based Routing (PBR) allows forwarding decisions to be based on criteria other than destination IP address. While normal IP routing uses destination-based forwarding with longest match lookup, PBR enables routing decisions based on source, destination, protocol type, or incoming interface. **Normal IP Routing** - Find the longest match to destination in routing table - Route the packet towards the next-hop **Policy-Based Routing** - Route based on defined policies and criteria - Override normal routing table decisions when policies match ## How PBR Works PBR uses route-maps to define traffic criteria and actions: **Route-Map Logic** - **Permit:** Apply policy routing to matching traffic - **Deny:** Use normal destination-based forwarding for matching traffic **Traffic Criteria:** Most commonly matched using access lists, but can also match on: - Packet length - Source interface - Destination interface ## Interface Application PBR should be applied on the **ingress interface** where the intended traffic is being received. This allows the router to make policy decisions before normal routing table lookup occurs. **Why Ingress Application:** - PBR processes packets as they enter an interface - Allows policy decisions before normal routing table lookup - More efficient than applying on multiple egress interfaces - Catches traffic at the entry point for consistent policy enforcement ## Configuration Example ``` ip access-list extended ICMP_TRAFFIC permit icmp 192.168.1.0 0.0.0.255 host 8.8.8.8 route-map PBR-ICMP permit 10 match ip address ICMP_TRAFFIC set ip next-hop 10.0.0.6 route-map PBR-ICMP permit 20 ! Deny statement - all other traffic uses normal routing interface Ethernet0/0 description LAN-Interface-Ingress ip policy route-map PBR-ICMP ``` **Configuration Breakdown:** - **Access List:** Defines ICMP traffic from 192.168.1.0/24 to 8.8.8.8 - **Route-Map Permit 10:** Matches the ACL and sets specific next-hop - **Route-Map Permit 20:** Empty permit acts as deny - normal routing for other traffic - **Interface Application:** Applied to ingress interface where LAN traffic enters ## Optional Default Next-Hop The `set ip default next-hop` command modifies PBR behavior to check the routing table first before applying the policy route: - **Standard PBR:** `set ip next-hop` - Forces traffic through specified next-hop regardless of routing table - **Default PBR:** `set ip default next-hop` - Uses routing table first, only applies PBR if no route exists ``` route-map PBR-DEFAULT permit 10 match ip address BACKUP_TRAFFIC set ip default next-hop 10.0.0.100 ``` **How Default Next-Hop Works** 1. Router checks routing table for destination 2. If route exists in RIB, uses normal routing 3. If no route exists in RIB, uses PBR next-hop 4. Provides backup routing when normal paths fail ## Local PBR For router-generated traffic (such as management, SNMP, or syslog), use local PBR: ``` ip local policy route-map PBR-LOCAL ``` This applies PBR to traffic originated by the router itself rather than transit traffic. ## Verification Commands ``` show ip policy show route-map show ip local policy debug ip policy show ip route policy ```