SOLVED
Hello @Luceluz !
Generally all the routers choose a route according destination. This is a general rule of IP routing, but you want to route by source instead of destination, so you need to use a mechanism that will override this rule. This mechanism is called Policy-based routing (PBR) and it uses user-defined policies to route packets. Check out this guide - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=c04771710, 'Configuring PBR' section. Look for 'Interface PBR', this is the PBR type you need.
If you need a quick hint, I think this is an example that suits your needs:
system-view
#
acl advanded 3333
rule 10 permit ip
#
policy-based-route VLAN200 permit node 10
if-match acl 3333
apply next-hop 10.10.1.252
#
policy-based-route VLAN300 permit node 10
if-match acl 3333
apply next-hop 10.10.1.253
#
policy-based-route ALL_OTHER_VLANS permit node 10
if-match acl 3333
apply next-hop 10.10.1.254
#
interface Vlan-interface200
ip policy-based-route VLAN200
#
interface Vlan-interface300
ip policy-based-route VLAN300
#
interface <any vlan-interface except 100, 200 and 300>
ip policy-based-route ALL_OTHER_VLANS
#
We created one common ACL that just match all the incoming traffic (rule 10 permit ip) then we used this ACL in all PBR policies. For example, PBR policy 'VLAN200' matches all incoming traffic on the Vlan-interface200 (according the ACL 3333) and routes it (apply-next-hop) over the 10.10.1.252 address. The rest of PBR policies work in the same way, just use different next-hops (default gateways).
Hope this helps!
BTW, we can optimize PBR policies a little bit in order to exclude the need of ACL:
policy-based-route VLAN200 permit node 10
if-match any
apply next-hop 10.10.1.252
#
policy-based-route VLAN300 permit node 10
if-match any
apply next-hop 10.10.1.253
#
policy-based-route ALL_OTHER_VLANS permit node 10
if-match any
apply next-hop 10.10.1.254Here instead of using ACL 3333 that matches all traffic according its rule 10 "permit ip", we just use "if-match any" to match everything that comes on the respective Vlan-interface. This practically makes ACL 3333 redundant and not needed. I am not sure if it will work on this model, but you can try this approach just in case... I don't see why it shouldn't work, but you never know until try it
Oh, you didn't mention you want to keep the inter-vlan routing... That will require a slight modification to the scenario.
I do not know your IP numbering plan and how you assign subnets, but let me offer you a general scenario when all traffic destined to 10.0.0.0/8 will be routed according the routing table, e.g. inter-vlan routing will work, and the rest of the traffic will be pushed to the respective gateways:
acl advanded 3332
rule 10 permit ip destination 10.0.0.0 0.255.255.255
#
acl advanced 3333
rule 10 permit ip
#
policy-based-route VLAN200 deny node 10
if-match acl 3332
#
policy-based-route VLAN200 permit node 20
if-match acl 3333
apply next-hop 10.10.1.252
#
policy-based-route VLAN300 deny node 10
if-match acl 3332
#
policy-based-route VLAN300 permit node 20
if-match acl 3333
apply next-hop 10.10.1.253
#
policy-based-route ALL_OTHER_VLANS deny node 10
if-match acl 3332
#
policy-based-route ALL_OTHER_VLANS permit node 20
if-match acl 3333
apply next-hop 10.10.1.254
#
interface Vlan-interface200
ip policy-based-route VLAN200
#
interface Vlan-interface300
ip policy-based-route VLAN300
#
interface any_vlan-interface_except_100, 200_and_300
ip policy-based-route ALL_OTHER_VLANS
The logic is pretty simple:
- define ACL 3332 that will match traffic destined to 10.0.0.0/8
- define ACL 3333 that matches all traffic
- create a deny policy node 10 the will match ACL 3332. Deny in this case means "stop processing PBR rules and route the packet according the routing table"
- create a permit policy node 20 that will activate only if the packet didn't match node 10, e.g. traffic that is NOT destined to 10.0.0.0/8. Apply the next-hop to push the traffic to respective next-hop.
Hi @Luceluz !
That is strange. I have made a quick proof-of-concept setup and it worked as expected. However, it is not on 5130 EI, but on virtual routers VSR1000. May be I have overlooked some specific of 5130 EI, let me try to set the lab with 5130s and I will test it once again. BTW, while I am testing, could you double-check that your PC in VLAN30 uses 5130's Vlan-interface30 IP address as default gateway - e.g. the switch must be the next-hop router for your hosts, otherwise PBR won't work.
@Luceluz good news. In order to investigate the PBR's behavior you can use debugging commands:
<HPE>terminal debugging
<HPE>debugging ip policy-based-route
.......
# In order to turn the debugging off, use following command:
<HPE>undo debugging all