LAN Routing

Policy Based Routing on 5406

Occasional Contributor

Policy Based Routing on 5406


I need some help in setting up a policy based route policy on our switches. I have a certain VLAN i want to set to use our new firewall for testing purposes 

But i just cant get the traffic to go to the new firewall at all i was wondering if anyone could help me out with the below and point me in the right direction?

class ipv4 "TCP"
10 match ip 213..121.240.192

policy pbr "BT"
10 class ipv4 "TCP"
action ip next-hop
exit - New Firewall

If anyone can help that would be great.





Re: Policy Based Routing on 5406

I know this is an old post but you will need to apply the policy you created to the VLAN or interface that the traffic will be coming in on.


vlan 1
service-policy "BT" in


Re: Policy Based Routing on 5406

The following example shows TCP and UDP traffic routed on different network paths:

Create the traffic classes:

Rack2sw1(config)# class ipv4 TCP
Rack2sw1(config-class)# match tcp eq 80
Rack2sw1(config-class)# match tcp eq 22
Rack2sw1(config-class)# match tcp eq 23
Rack2sw1(config-class)# exit

Rack2sw1(config)# class ipv4 UDP
Rack2sw1(config-class)# match udp eq 80
Rack2sw1(config-class)# match udp eq 22
Rack2sw1(config-class)# match udp eq 23
Rack2sw1(config-class)# exit


Verify traffic classes:

Rack2sw1(config)# show class config

class ipv4 "TCP"
     10 match tcp eq 80
     20 match tcp eq 22
     30 match tcp eq 23
class ipv4 "UDP"
     10 match udp eq 80
     20 match udp eq 22
     30 match udp eq 23


Create the routing policy:

Rack2sw1(config)# policy pbr TCP_UDP
Rack2sw1(policy-pbr)# class ipv4 TCP
Rack2sw1(policy-pbr-class)# action ip next-hop
Rack2sw1(policy-pbr-class)# action interface null
Rack2sw1(policy-pbr-class)# exit

Rack2sw1(policy-pbr)# class ipv4 UDP
Rack2sw1(policy-pbr-class)# action ip default-next-hop
Rack2sw1(policy-pbr-class)# action interface tunnel 3
Rack2sw1(policy-pbr-class)# exit


Verify the routing policy:

Rack2sw1# show policy config

policy pbr "TCP_UDP"
     10 class ipv4 "TCP"
      action ip next-hop
      action interface null
     20 class ipv4 "UDP"
      action ip default-next-hop
      action interface tunnel 3


Configure the VLAN for the service policy:

Rack2sw1(config)# vlan 10 service-policy TCP_UDP in


Verify the vlan policy configuration:

Rack2sw1# show policy vlan 10

 Policies for VLAN 10
 Name   : TCP_UDP
 Type   : PBR


Use the show statistics policy command to display information about which PBR action for an applied policy is active. Hit counts are displayed for each entry in the class and policy with the active action.

Rack2sw1# show statistics policy TCP_UDP vlan 10 in

 HitCounts for Policy TCP_UDP


 10 class ipv4 TCP action interface null
(       0 )      10 match tcp eq 80
(       0 )      20 match tcp eq 22
(       0 )      30 match tcp eq 23

 20 class ipv4 UDP action ignore
(       0 )      10 match udp eq 80
(       0 )      20 match udp eq 22
(       0 )      30 match udp eq 23

I am an HPE Employee

Accept or Kudo