3.2.d Describe policy-based routing

What this objective tests

The objective says "describe". The exam wants you to read a route map and predict the path a packet takes.

Normal routing is destination-based. The router checks the routing table and forwards the packet to the best next hop. Policy-Based Routing (PBR) overrides that decision for matched traffic. PBR can ask: who sent this packet, and which path should this class of traffic use?

Use PBR when the routing table is too blunt. Examples:

• Send one subnet over a second ISP link.
• Send voice traffic over a low-latency path.
• Send backup traffic over a cheaper circuit.

How PBR works

PBR uses a route map on the inbound interface:

• A permit sequence with a match and a set action policy-routes the matched traffic.
• A deny sequence with a match exempts that traffic from PBR. It uses normal routing.
• Traffic that matches no sequence uses normal routing.

The ACL inside the route map classifies traffic. It does not filter traffic.

Packet enters interface Gi0/0
  -> route-map check (match? set?)
  -> matched: forward to the set next-hop
  -> not matched: normal routing table lookup

Example: send one subnet over a second ISP link

Topology:

Users 10.10.10.0/24 -- Gi0/0
                        R1 -- Gi0/1 198.51.100.2/30 -- ISP1 (default route)
Voice 10.10.20.0/24 -- Gi0/2
                        R1 -- Gi0/3 203.0.113.2/30  -- ISP2

Requirement: the voice subnet 10.10.20.0/24 must use ISP2. All other traffic uses the default route through ISP1.

R1:

interface GigabitEthernet0/2
 description Voice VLAN gateway
 ip address 10.10.20.1 255.255.255.0
 ip policy route-map VOICE-TO-ISP2
!
interface GigabitEthernet0/3
 description To ISP2
 ip address 203.0.113.2 255.255.255.252
!
ip access-list extended VOICE-SUBNET
 permit ip 10.10.20.0 0.0.0.255 any
!
route-map VOICE-TO-ISP2 permit 10
 match ip address VOICE-SUBNET
 set ip next-hop 203.0.113.1
!
ip route 0.0.0.0 0.0.0.0 198.51.100.1

The route map applies inbound on the voice gateway interface. The set ip next-hop command sends matched packets to ISP2 at 203.0.113.1.

Note: set ip next-hop always overrides routing for matched traffic. set ip default next-hop applies only when the routing table has no route for the destination. Do not confuse the two.

Expected verification output

R1# show route-map VOICE-TO-ISP2
route-map VOICE-TO-ISP2, permit, sequence 10
  Match clauses:
    ip address (access-lists): VOICE-SUBNET
  Set clauses:
    ip next-hop 203.0.113.1
  Policy routing matches: 248 packets, 15872 bytes

The counters matter. If the packet count stays at zero, traffic does not match or the policy is on the wrong interface.

Check where the policy applies:

R1# show ip policy
Interface       Route map
Gi0/2           VOICE-TO-ISP2

Verify the decision with debug

debug ip policy shows each policy-routing decision in real time:

R1# debug ip policy
IP: s=10.10.20.10 (GigabitEthernet0/2), d=198.51.100.50, len 100, policy match
IP: route map VOICE-TO-ISP2, item 10, permit
IP: s=10.10.20.10 (GigabitEthernet0/2), d=198.51.100.50 (GigabitEthernet0/3), len 100, policy routed

The debug shows the match, the route-map item, and the new outgoing interface.

Warning: Debug commands can overload a busy router and cause an outage. Use debug ip policy in a lab or during a maintenance window. Stop all debug output with undebug all when you finish.

PBR and the routing table

PBR does not remove the need for routing. The set next hop must still be reachable. Check it:

show ip route 203.0.113.1
ping 203.0.113.1
show arp | include 203.0.113.1

If the ISP2 next hop fails, matched traffic can fail with it. For a safer design, track the next hop with IP Service Level Agreement (IP SLA) and use set ip next-hop verify-availability.

Exam traps

• PBR applies inbound on the interface where traffic enters the router.
• A route-map deny sequence means "use normal routing", not "drop the packet".
• Traffic that matches no sequence uses normal routing.
• The PBR next hop must be reachable. Check the route table and ARP.
• Route-map counters are the fastest proof that the policy matches traffic.
• set ip next-hop and set ip default next-hop are different behaviors.

Pass check

You are ready when you can do these things:

• Describe how a route map changes the path of a matched packet.
• Predict the result of permit, deny, and no-match sequences.
• Read show route-map counters and state whether the policy works.
• Explain when debug ip policy is safe to use.