HPE Community read-only access December 15, 2018
This is a maintenance upgrade. You will be able to read articles and posts, but not post or reply.
Hours:
Dec 15, 4:00 am to 10:00 am UTC
Dec 14, 10:00 pm CST to Dec 15, 4:00 am CST
Dec 14, 8:00 pm PST to Dec 15, 2:00 am PST
LAN Routing
cancel
Showing results for 
Search instead for 
Did you mean: 

Policy Based Routing on 5406

 
ScottLangshaw
Occasional Contributor

Policy Based Routing on 5406

Hello 

I need some help in setting up a policy based route policy on our switches. I have a certain VLAN i want to set to use our new firewall for testing purposes 

But i just cant get the traffic to go to the new firewall at all i was wondering if anyone could help me out with the below and point me in the right direction?

class ipv4 "TCP"
10 match ip 10.77.0.0 0.0.255.255 213..121.240.192 0.0.0.15
exit


policy pbr "BT"
10 class ipv4 "TCP"
action ip next-hop 10.40.208.135
exit

10.40.208.135 - New Firewall

If anyone can help that would be great.

Regards,

Scott

 

2 REPLIES
michelle79
Advisor

Re: Policy Based Routing on 5406

I know this is an old post but you will need to apply the policy you created to the VLAN or interface that the traffic will be coming in on.

Example:

vlan 1
service-policy "BT" in
exit

network_king
HPE Pro

Re: Policy Based Routing on 5406

The following example shows TCP and UDP traffic routed on different network paths:

Create the traffic classes:


Rack2sw1(config)# class ipv4 TCP
Rack2sw1(config-class)# match tcp 10.0.8.1/24 15.29.16.104/24 eq 80
Rack2sw1(config-class)# match tcp 10.0.8.1/24 15.29.16.104/24 eq 22
Rack2sw1(config-class)# match tcp 10.0.8.1/24 15.29.16.104/24 eq 23
Rack2sw1(config-class)# exit

Rack2sw1(config)# class ipv4 UDP
Rack2sw1(config-class)# match udp 10.0.8.1/24 15.29.16.104/24 eq 80
Rack2sw1(config-class)# match udp 10.0.8.1/24 15.29.16.104/24 eq 22
Rack2sw1(config-class)# match udp 10.0.8.1/24 15.29.16.104/24 eq 23
Rack2sw1(config-class)# exit

 

Verify traffic classes:


Rack2sw1(config)# show class config

class ipv4 "TCP"
     10 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 80
     20 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 22
     30 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 23
   exit
class ipv4 "UDP"
     10 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 80
     20 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 22
     30 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 23
   exit

 

Create the routing policy:


Rack2sw1(config)# policy pbr TCP_UDP
Rack2sw1(policy-pbr)# class ipv4 TCP
Rack2sw1(policy-pbr-class)# action ip next-hop 20.0.0.1
Rack2sw1(policy-pbr-class)# action interface null
Rack2sw1(policy-pbr-class)# exit

Rack2sw1(policy-pbr)# class ipv4 UDP
Rack2sw1(policy-pbr-class)# action ip default-next-hop 30.0.0.1
Rack2sw1(policy-pbr-class)# action interface tunnel 3
Rack2sw1(policy-pbr-class)# exit

 

Verify the routing policy:


Rack2sw1# show policy config

policy pbr "TCP_UDP"
     10 class ipv4 "TCP"
      action ip next-hop 20.0.0.1
      action interface null
      exit
     20 class ipv4 "UDP"
      action ip default-next-hop 30.0.0.1
      action interface tunnel 3
      exit
   exit

 

Configure the VLAN for the service policy:


Rack2sw1(config)# vlan 10 service-policy TCP_UDP in

 

Verify the vlan policy configuration:


Rack2sw1# show policy vlan 10

 Policies for VLAN 10
 Name   : TCP_UDP
 Type   : PBR

 

Use the show statistics policy command to display information about which PBR action for an applied policy is active. Hit counts are displayed for each entry in the class and policy with the active action.


Rack2sw1# show statistics policy TCP_UDP vlan 10 in

 HitCounts for Policy TCP_UDP

  Total

 10 class ipv4 TCP action interface null
(       0 )      10 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 80
(       0 )      20 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 22
(       0 )      30 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 23

 20 class ipv4 UDP action ignore
(       0 )      10 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 80
(       0 )      20 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 22
(       0 )      30 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 23

I am an HPE Employee

Please consider marking it as an Accepted Solution if issue is resolved. Register a Kudo by clicking the thumb if this helped in your issue.