3.2.d Describe policy-based routing

Normal routing is destination-based. The router looks at the destination IP address, checks the routing table, and forwards the packet to the best next hop.

Policy-Based Routing, or PBR, lets you override that behavior for selected traffic. Instead of asking only “Where is this packet going?” the router can ask “Who sent it, what kind of traffic is it, and where do I want this class of traffic to go?”

When PBR is useful

Use PBR when the routing table is too blunt.

Examples:

• Send guest traffic to an internet firewall.
• Send voice traffic through a low-latency WAN path.
• Send backup traffic through a cheaper circuit.
• Force a subset of hosts to use a different next hop.

Do not use PBR when normal routing design can solve the problem cleanly. PBR is powerful, but it is also easy to forget because it happens before the normal route lookup for matched traffic.

Basic logic

PBR uses a route map:

Route-map match · ACL or packet field
Permit sequence · set next-hop or output interface
No match or deny sequence · normal routing table lookup

The route map is applied to an inbound interface. That matters. PBR affects packets as they enter the router, not as they leave.

Route-map permit and deny matter:

• route-map NAME permit 10 with a match and set action applies PBR to matching traffic.
• route-map NAME deny 20 with a match exempts matching traffic from PBR; it falls back to normal destination-based routing.
• Traffic that matches no route-map sequence also falls back to normal routing.

The ACL inside the route map classifies traffic. It is not a packet filter by itself.

Packet arrives inside interface
route-map SEND-TO-ISP-B · inbound
set ip next-hop 192.0.2.2 · ISP-B
Destination-based forwarding · routing table

PBR is easy to forget in troubleshooting because the route table can look correct while one host still takes a special path.

Example topology

Users VLAN 10
R1
ISP-A
ISP-B

Requirement: traffic from host 10.10.10.50 should use ISP-B next hop 192.0.2.2. Other users should use normal routing.

Configuration

ip access-list extended PBR-SPECIAL-HOST
 permit ip host 10.10.10.50 any
!
route-map SEND-TO-ISP-B permit 10
 match ip address PBR-SPECIAL-HOST
 set ip next-hop 192.0.2.2
!
interface GigabitEthernet0/0
 description Users VLAN 10 gateway
 ip address 10.10.10.1 255.255.255.0
 ip policy route-map SEND-TO-ISP-B

Verify:

show route-map SEND-TO-ISP-B
show ip policy
show run interface gi0/0
show access-lists PBR-SPECIAL-HOST

The route map counters are important. If counters stay at zero, traffic is not matching or the policy is applied to the wrong interface.

Safer next-hop behavior

If the PBR next hop fails, the router may still try to use it depending on the configuration. Use tracked next-hop logic when available and appropriate.

ip sla 10
 icmp-echo 192.0.2.2 source-interface GigabitEthernet0/1
 frequency 5
ip sla schedule 10 life forever start-time now
!
track 10 ip sla 10 reachability
!
route-map SEND-TO-ISP-B permit 10
 match ip address PBR-SPECIAL-HOST
 set ip next-hop verify-availability 192.0.2.2 10 track 10

Verify:

show ip sla statistics
show track 10
show route-map SEND-TO-ISP-B

The verify-availability form only helps when the track object represents the next-hop condition you actually care about. If the track object is down, matched traffic falls back to normal destination-based routing rather than being forced toward a known-dead next hop.

set ip default next-hop is different from set ip next-hop. set ip next-hop overrides normal routing for matched traffic. set ip default next-hop is used only when the normal routing table has no explicit route for the destination. That difference is a common interpretation trap.

Local PBR

Interface PBR affects transit traffic entering an interface. Locally generated traffic from the router itself can use local PBR:

ip local policy route-map ROUTER-TRAFFIC

This is less common on ENCOR questions, but the distinction matters.

PBR and the routing table

PBR does not remove the need for routing. The chosen next hop must still be reachable at Layer 2/Layer 3. If the next hop is impossible, traffic fails or falls back depending on the exact set action.

You should still check:

show ip route 192.0.2.2
ping 192.0.2.2
show arp | include 192.0.2.2

Lab: Send one host through a different path

Topology

HostA 10.10.10.50
R1
R2 · ISP-A
HostB 10.10.10.60
R3 · ISP-B

R1 has a default route through R2. You want HostA to use R3.

Task 1: Confirm normal routing

On R1:

show ip route 0.0.0.0
traceroute 8.8.8.8 source 10.10.10.1

Task 2: Configure PBR

ip access-list extended HOSTA-PBR
 permit ip host 10.10.10.50 any
!
route-map HOSTA-TO-R3 permit 10
 match ip address HOSTA-PBR
 set ip next-hop 10.13.0.3
!
interface gi0/0
 ip policy route-map HOSTA-TO-R3

Task 3: Test

From HostA, traceroute to an outside address. From HostB, do the same. HostA should use R3; HostB should use normal routing.

Task 4: Verify counters

show route-map HOSTA-TO-R3
show ip policy

Exam traps

• PBR is applied inbound on the interface where traffic enters.
• Route map sequence order matters.
• If no route-map sequence matches, traffic uses normal routing.
• Matching ACLs in PBR classify traffic; they are not filtering traffic by themselves.
• PBR next hops must be reachable.
• Route-map counters are your friend.
• A route-map deny sequence means "do not policy-route this matched traffic," not "drop this traffic."
• set ip default next-hop is fallback behavior, not the same as always forcing a next hop.

Quick checklist

1. Which traffic should be treated differently?
2. Is the match ACL correct?
3. Is the route map applied inbound on the right interface?
4. Is the next hop reachable?
5. Are route-map counters increasing?
6. Is there a fallback if the policy next hop fails?