Aruba 2930f - Policy based routing not working?

[JarlBalgruuf]

In my continued fight with the Aruba 2930f, I'm not able to get policy based routing to work.  We have 3 gateways at the data center.  Particular VLANs/traffic need to go to particular gateways.  A snippet of the configuration is below.  The way the configuration is right now, "spx" traffic will flow, but "hosting" traffic will not.  If I change the default route (ip route 0.0.0.0 0.0.0.0 192.168.153.254) to ip route 0.0.0.0 0.0.0.0 172.21.1.240, hosting traffic will flow but spx traffic will not.  It is as if the pbr is being ignored completely.  What am I doing wrong?

class ipv4 “spx”

                10 match ip 192.168.153.0 0.0.0.255 0.0.0.0 255.255.255.255

       exit

class ipv4 “hosting”

                10 match ip 172.21.0.0 0.0.255.255 0.0.0.0 255.255.255.255

        exit

policy pbr “hosting traffic”

                10 class ipv4 “hosting”

                action ip next-hop 172.21.1.240

                exit

     exit

policy pbr “spx traffic”

                10 class ipv4 “spx”

                action ip next-hop 192.168.153.254

                exit

     exit

ip route 0.0.0.0 0.0.0.0 192.168.153.254

ip routing

[Emil_G]

Hello @JarlBalgruuf 

The PBR policy has to be applied to an interface in order to perform what is supposed to. From the configuration snippets you provided I cannot see if this was done. Please provide the VLAN configuration or even better the whole running configuration of the switch.

For reference you can have a look at Chapter 10 Policy Based Routing of the Multicast and Routing Guide, page 234. There is also an example there and you can see that the last command applies the policy to the VLAN.

https://support.hpe.com/hpesc/public/docDisplay?docId=a00091308en_us

[parnassus]

Hi! as @Emil_G remembered you the service policy needs to be applied (on desired VLANs) and this can be achieved by using the command vlan [vlan-id] service-policy [policy-name] in.

Let's suppose VLAN 2 refers to 192.168.153.0/24 and you want to apply the policy pbr "spx traffic" then vlan 2 service-policy “spx traffic” in, cleary that service policy should also be paired with the other vlan 1 service-policy "hosting traffic" in (supposing the VLAN 1 is referring to 172.21.0.0/16) valid for VLAN 1.

Edit: Chapter 14 "Classifier-based software configuration" (starting at 366/424) of Aruba 2930F/2930M Advanced TrafficManagement Guide for ArubaOS-Switch 16.10  goes pretty deep with regards to PBR (See figure 64 on page 394/424).

[JarlBalgruuf]

Ok, I added the service-policy to VLAN 1.  It is now routing properly, however I can't access the switch via telnet or the web interface from that VLAN anymore.  I was able to pull the config by getting to it on the other VLAN, but this won't be an acceptable path forward.  Is there something I need to change in order to make the device telnet accessible on VLAN 1?

Startup configuration: 91

; JL260A Configuration Editor; Created on release #WC.16.10.0005
; Ver #14:27.6f.f8.1d.9b.3f.bf.bb.ef.7c.59.fc.6b.fb.9f.fc.ff.ff.37.ef:04
hostname "Switch1"
module 1 type jl260a
class ipv4 "spx"
10 match ip 192.168.153.0 0.0.0.255 0.0.0.0 255.255.255.255
exit
class ipv4 "hosting"
10 match ip 172.21.0.0 0.0.255.255 0.0.0.0 255.255.255.255
exit
policy pbr "hosting traffic"
10 class ipv4 "hosting"
action ip next-hop 172.21.1.240
exit
exit
policy pbr "spx traffic"
10 class ipv4 "spx"
action ip next-hop 192.168.153.254
exit
exit
time timezone -6
ip access-list extended "FDC"
10 permit ip 172.21.1.72 0.0.0.0 192.168.153.0 0.0.0.255
20 permit ip 192.168.153.0 0.0.0.255 172.21.1.72 0.0.0.0
40 deny ip 172.21.0.0 0.0.255.255 192.168.153.0 0.0.0.255
50 deny ip 192.168.153.0 0.0.0.255 172.21.0.0 0.0.255.255
60 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
ip route 0.0.0.0 0.0.0.0 192.168.153.254
ip routing
snmp-server community "aitsnmp" unrestricted
vlan 1
name "Hosting"
no untagged 21-48
untagged 1-20,49-52
ip access-group "FDC" in
ip address 172.21.1.242 255.255.0.0
ipv6 enable
ipv6 address autoconfig
service-policy "hosting traffic" in
exit
vlan 2
name "SPX"
untagged 33-48
ip access-group "FDC" in
ip address 192.168.153.251 255.255.255.0
ipv6 enable
ipv6 address autoconfig
exit
vlan 3
name "WAN"
untagged 21-32
no ip address
ipv6 enable
ipv6 address autoconfig
exit
no tftp server
no autorun
no dhcp config-file-update
no dhcp image-file-update
password manager

[Emil_G]

Hello, 

I am not sure if I understand fully the scenario, thats why I would like to ask for more details in order to understand how exactly the PBR is affecting the management traffic.

Which IP interface on the switch do you want to use for management - VLAN 1 or VLAN 2?

In which VLAN (resp IP subnet) is placed the management PC from which you are trying to establish Telnet/HTTPs connection with the switch? Is it connected to the same switch or some other switch? Which device is the gateway of the management PC?

Should the next hop 172.21.1.240 that you specified for VLAN 1 in the PBR policy be able to route to the subnet of the management PC?

If you do a tracert resp traceroute from both the management PC and the switch can you see where exactly the communication is breaking? For traceroute from the switch it is important to specify the source interface.

[JarlBalgruuf]

Which IP interface on the switch do you want to use for management - VLAN 1 or VLAN 2?

            VLAN1 primarily, though it would be best if it was accessible on VLAN1 and VLAN2

In which VLAN (resp IP subnet) is placed the management PC from which you are trying to establish Telnet/HTTPs connection with the switch? Is it connected to the same switch or some other switch? Which device is the gateway of the management PC?

          Right now the management PC is on VLAN1.  it's IP is 172.21.1.72 and it is connected directly to the 2930F, using the 2930F as its gateway.

Should the next hop 172.21.1.240 that you specified for VLAN 1 in the PBR policy be able to route to the subnet of the management PC?

          The next hop of 172.21.1.240 is the Firewall which allows the PC to get to the Internet

If you do a tracert resp traceroute from both the management PC and the switch can you see where exactly the communication is breaking? For traceroute from the switch it is important to specify the source interface.

          Doing a traceroute from the management PC to the switch it times out at the first hop (172.21.1.242, which is the IP of the switch).  I found how to run a traceroute command from the switch, but I don't know how to specify a source interface, and the Aruba documentation I found doesn't say how to do that either.

[Emil_G]

Hello

You can use the source argument in order to specify source interface.

2930F# traceroute ?
HOST-NAME-STR Hostname of the destination device.
IP-ADDR Destination IPv4 address.
source Source address or VLAN or loopback.
2930F# traceroute

[JarlBalgruuf]

I tried that but it just says invalid argument.

[Emil_G]

Strange I can use the source argument. After source you can either speicify vlan ID (only the integer without VLAN) or the IP address of the VLAN.

Anyway: Could you please test if changing the action in the PBR policy "hosting traffic" will have any effect. Please use the action "ip default-next-hop" instead of "ip next-hop" and observe if management access is possible

[JarlBalgruuf]

I really hate that all this is done through CLI.  When I try to do "no action ip next-hop 172.21.1.240" it says "invalid input: action" and will not let me remove that line.  I tried adding the action ip default-next-hop 172.21.1.240 to see if it would override it, but now they are both in there.