IPv6 Policy-Based Routing

Policy-based routing (PBR) in both IPv6 and IPv4 allows a user to manually configure how received packets should be routed. PBR allows the user to identify packets by using several attributes and to specify the next hop or the output interface to which the packet should be sent. PBR also provides a basic packet-marking capability.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Information About IPv6 Policy-Based Routing

Policy-Based Routing Overview

Policy-based routing (PBR) gives you a flexible means of routing packets by allowing you to configure a defined policy for traffic flows, which lessens reliance on routes derived from routing protocols. Therefore, PBR gives you more control over routing by extending and complementing the existing mechanisms provided by routing protocols. PBR allows you to set the IPv6 precedence. For a simple policy, you can use any one of these tasks; for a complex policy, you can use all of them. It also allows you to specify a path for certain traffic, such as priority traffic over a high-cost link.

PBR for IPv6 may be applied to both forwarded and originated IPv6 packets. For forwarded packets, PBR for IPv6 will be implemented as an IPv6 input interface feature, supported in the following forwarding paths:

  • Process
  • Cisco Express Forwarding (formerly known as CEF)
  • Distributed Cisco Express Forwarding

Policies can be based on the IPv6 address, port numbers, protocols, or packet size.

PBR allows you to perform the following tasks:

  • Classify traffic based on extended access list criteria. Access lists, then, establish the match criteria.
  • Set IPv6 precedence bits, giving the network the ability to enable differentiated classes of service.
  • Route packets to specific traffic-engineered paths; you might need to route them to allow a specific quality of service (QoS) through the network.

PBR allows you to classify and mark packets at the edge of the network. PBR marks a packet by setting precedence value. The precedence value can be used directly by devices in the network core to apply the appropriate QoS to a packet, which keeps packet classification at your network edge.

How Policy-Based Routing Works

All packets received on an interface with policy-based routing (PBR) enabled are passed through enhanced packet filters called route maps. The route maps used by PBR dictate the policy, determining where to forward packets.

Route maps are composed of statements. The route map statements can be marked as permit or deny, and they are interpreted in the following ways:

  • If a packet matches all match statements for a route map that is marked as permit, the device attempts to policy route the packet using the set statements. Otherwise, the packet is forwarded normally.
  • If the packet matches any match statements for a route map that is marked as deny, the packet is not subject to PBR and is forwarded normally.
  • If the statement is marked as permit and the packets do not match any route map statements, the packets are sent back through normal forwarding channels and destination-based routing is performed.

You must configure policy-based routing (PBR) on the interface that receives the packet, and not on the interface from which the packet is sent.

Packet Matching

Policy-based routing (PBR) for IPv6 will match packets using the match ipv6 address command in the associated PBR route map. Packet match criteria are those criteria supported by IPv6 access lists, as follows:

  • Input interface
  • Source IPv6 address (standard or extended access control list [ACL])
  • Destination IPv6 address (standard or extended ACL)
  • Protocol (extended ACL)
  • Source port and destination port (extended ACL)
  • DSCP (extended ACL)
  • Flow-label (extended ACL)
  • Fragment (extended ACL)

Packets may also be matched by length using the match length command in the PBR route map.

Match statements are evaluated first by the criteria specified in the match ipv6 address command and then by the criteria specified in the match length command. Therefore, if both an ACL and a length statement are used, a packet will first be subject to an ACL match. Only packets that pass the ACL match will be subject to the length match. Finally, only packets that pass both the ACL and the length statement will be policy routed.

Packet Forwarding Using Set Statements

Policy-based routing (PBR) for IPv6 packet forwarding is controlled by using a number of set statements in the PBR route map. These set statements are evaluated individually in the order shown, and PBR will attempt to forward the packet using each of the set statements in turn. PBR evaluates each set statement individually, without reference to any prior or subsequent set statement.

You may set multiple forwarding statements in the PBR for IPv6 route map. The following set statements may be specified:

  • IPv6 next hop. The next hop to which the packet should be sent. The next hop must be present in the Routing Information Base (RIB), it must be directly connected, and it must be a global IPv6 address. If the next hop is invalid, the set statement is ignored.
  • Output interface. A packet is forwarded out of a specified interface. An entry for the packet destination address must exist in the IPv6 RIB, and the specified output interface must be in the set path. If the interface is invalid, the statement is ignored.
  • Default IPv6 next hop. The next hop to which the packet should be sent. It must be a global IPv6 address. This set statement is used only when there is no explicit entry for the packet destination in the IPv6 RIB.
  • Default output interface. The packet is forwarded out of a specified interface. This set statement is used only when there is no explicit entry for the packet destination in the IPv6 RIB.

Note

The order in which PBR evaluates the set statements is the order in which they are listed above. This order may differ from the order in which route-map set statements are listed by show commands.

When to Use Policy-Based Routing

Policy-based routing (PBR) can be used if you want certain packets to be routed some way other than the obvious shortest path. For example, PBR can be used to provide the following functionality:

  • Equal access
  • Protocol-sensitive routing
  • Source-sensitive routing
  • Routing based on interactive traffic versus batch traffic
  • Routing based on dedicated links

Some applications or traffic can benefit from Quality of Service (QoS)-specific routing; for example, you could transfer stock records to a corporate office on a higher-bandwidth, higher-cost link for a short time while sending routine application data such as e-mail over a lower-bandwidth, lower-cost link.

How to Enable IPv6 Policy-Based Routing

Enabling PBR on an Interface

To enable PBR for IPv6, create a route map that specifies the packet match criteria and the desired policy-route action. Then, associate the route map on the required interface. All packets arriving on the specified interface that match the match clauses will be subject to PBR.

Depending on your release, IPv6 PBR allows users to override normal destination IPv6 address-based routing and forwarding results. VPN routing and forwarding (VRF) allows multiple routing instances in Cisco software. The PBR feature is VRF-aware, which means that it works under multiple routing instances, beyond the default or global routing table.

In PBR, the set vrf command decouples the VRF and interface association and allows the selection of a VRF based on ACL-based classification using existing PBR or route-map configurations. PBR, through the set vrf command, provides a single device with multiple routing tables and the ability to select routes based on ACL classification. The device classifies packets based on ACL, selects a routing table, looks up the destination address, and then routes the packet.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    route-map map-tag [permit | deny] [sequence-number]

    4.    Enter one of the following commands:

    • match length minimum-length maximum-length
    • match ipv6 address {prefix-list prefix-list-name | access-list-name}

    5.    Enter one of the following commands:

    • set ipv6 precedence precedence-value
    • set ipv6 next-hop global-ipv6-address [global-ipv6-address...]
    • set interface type number [...type number]
    • set ipv6 default next-hop global-ipv6-address [global-ipv6-address...]
    • set default interface type number [...type number]
    • set vrf vrf-name

    6.    exit

    7.    interface type number

    8.    ipv6 policy route-map route-map-name

    9.    end


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Device> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.
     
    Step 2 configure terminal


    Example:
    Device# configure terminal
     

    Enters global configuration mode.

     
    Step 3 route-map map-tag [permit | deny] [sequence-number]


    Example:
    Device(config)# route-map rip-to-ospf permit
     

    Enters route-map configuration mode and defines conditions for redistributing routes from one routing protocol into another or enables policy routing.

     
    Step 4Enter one of the following commands:
    • match length minimum-length maximum-length
    • match ipv6 address {prefix-list prefix-list-name | access-list-name}


    Example:
    Device(config-route-map)# match length 3 200
    Device(config-route-map)# match ipv6 address marketing
     

    Specifies the match criteria.

    • You can specify any or all of the following:
      • Match the Level 3 length of the packet.
      • Match a specified IPv6 access list.
      • If you do not specify a match command, the route map applies to all packets.
     
    Step 5Enter one of the following commands:
    • set ipv6 precedence precedence-value
    • set ipv6 next-hop global-ipv6-address [global-ipv6-address...]
    • set interface type number [...type number]
    • set ipv6 default next-hop global-ipv6-address [global-ipv6-address...]
    • set default interface type number [...type number]
    • set vrf vrf-name


    Example:
    Device(config-route-map)# set ipv6 precedence 1
    Device(config-route-map)# set ipv6 next-hop 2001:DB8:2003:1::95
    Device(config-route-map)# set interface serial 0/0
    Device(config-route-map)# set ipv6 default next-hop 2001:DB8:2003:1::95
    Device(config-route-map)# set default interface ethernet 0
    Device(config-route-map)# set vrf vrfname
     

    Specifies the action or actions to be taken on the packets that match the criteria.

    • You can specify any or all of the following actions:
      • Set the precedence value in the IPv6 header.
      • Set the next hop for the packet (the next hop must be an adjacent device).
      • Set output interface for the packet.
      • Set the next hop for the packet, if there is no explicit route for this destination.
      • Set the output interface for the packet, if there is no explicit route for this destination.
      • Set VRF instance selection within a route map for a policy-based routing VRF selection.
     
    Step 6 exit


    Example:
    Device(config-route-map)# exit
     

    Returns to global configuration mode.

     
    Step 7 interface type number


    Example:
    Device(config)# interface FastEthernet 1/0
     

    Specifies an interface type and number and enters interface configuration mode.

     
    Step 8 ipv6 policy route-map route-map-name


    Example:
    Device(config-if)# ipv6 policy-route-map interactive
     

    Identifies a route map to be used for IPv6 PBR on an interface.

     
    Step 9 end


    Example:
    Device(config-if)# end
     

    Returns to privileged EXEC mode.

     

    Enabling Local PBR for IPv6

    Packets that are generated by the device are not normally policy routed. Perform this task to enable local IPv6 policy-based routing (PBR) for such packets, indicating which route map the device should use.

    SUMMARY STEPS

      1.    enable

      2.    configure terminal

      3.    ipv6 local policy route-map route-map-name

      4.    end


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example:
      Device> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.
       
      Step 2 configure terminal


      Example:
      Device# configure terminal
       

      Enters global configuration mode.

       
      Step 3 ipv6 local policy route-map route-map-name


      Example:
      Device(config)# ipv6 local policy route-map pbr-src-90
       

      Configures IPv6 PBR for packets generated by the device.

       
      Step 4 end


      Example:
      Device(config)# end
       

      Returns to privileged EXEC mode.

       

      Verifying the Configuration and Operation of PBR for IPv6

      SUMMARY STEPS

        1.    enable

        2.    show ipv6 policy


      DETAILED STEPS
         Command or ActionPurpose
        Step 1 enable


        Example:
        Device> enable
         

        Enables privileged EXEC mode.

        • Enter your password if prompted.
         
        Step 2 show ipv6 policy


        Example:
        Device# show ipv6 policy
         

        Displays IPv6 policy routing packet activity.

         

        Troubleshooting PBR for IPv6

        Policy routing analyzes various parts of the packet and then routes the packet based on certain user-defined attributes in the packet.

        SUMMARY STEPS

          1.    enable

          2.    show route-map [map-name | dynamic [dynamic-map-name | application [application-name]] | all] [detailed]

          3.    debug ipv6 policy [access-list-name]


        DETAILED STEPS
           Command or ActionPurpose
          Step 1 enable


          Example:
          Device> enable
           

          Enables privileged EXEC mode.

          • Enter your password if prompted.
           
          Step 2 show route-map [map-name | dynamic [dynamic-map-name | application [application-name]] | all] [detailed]


          Example:
          Device# show route-map
           

          Displays all route maps configured or only the one specified.

           
          Step 3 debug ipv6 policy [access-list-name]


          Example:
          Device# debug ipv6 policy
           

          Enables debugging of the IPv6 policy routing packet activity.

           

          Configuration Examples for IPv6 Policy-Based Routing

          Example: Enabling PBR on an Interface

          In the following example, a route map named pbr-dest-1 is created and configured. The route map specifies the packet match criteria and the desired policy-route action. PBR is then enabled on Ethernet interface 0/0. 

          ipv6 access-list match-dest-1
  permit ipv6 any 2001:DB8:2001:1760::/32
route-map pbr-dest-1 permit 10
  match ipv6 address match-dest-1
  set interface serial 0/0
interface Ethernet0/0
  ipv6 policy route-map interactive

          Example: Enabling Local PBR for IPv6

          In the following example, packets with a destination IPv6 address that match the IPv6 address range allowed by access list pbr-src-90 are sent to the device at IPv6 address 2001:DB8:2003:1::95: 

          ipv6 access-list src-90
  permit ipv6 host 2001:DB8:2003::90 2001:DB8:2001:1000::/64
route-map pbr-src-90 permit 10
  match ipv6 address src-90
  set ipv6 next-hop 2001:DB8:2003:1::95
ipv6 local policy route-map pbr-src-90

          Example: Verifying IPv6 PBR Configuration

          The following sample output from the show ipv6 policy command displays the IPv6 PBR configuration enabled on interface Ethernet interface 0/0: 

          Device# show ipv6 policy

Interface                 Routemap
Ethernet0/0               src-1

          Example: Verifying Route-Map Information

          The following sample output from the show route-map command displays specific route-map information, such as a count of policy matches: 

          Device# show route-map

route-map bill, permit, sequence 10
  Match clauses:
  Set clauses:
  Policy routing matches:0 packets, 0 bytes

          Additional References

          Related Documents

          Related Topic

          Document Title

          Cisco IOS commands

          Cisco IOS Master Command List, All Releases

          IPv6 addressing and connectivity

          IPv6 Configuration Guide

          IPv6 commands

          Cisco IOS IPv6 Command Reference

          Cisco IOS IPv6 features

          Cisco IOS IPv6 Feature Mapping

          Technical Assistance

          Description

          Link

          The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

          http:/​/​www.cisco.com/​cisco/​web/​support/​index.html

          Feature Information for IPv6 Policy-Based Routing

          The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

          Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

          Table 1 Feature Information for IPv6 Policy-Based Routing

          Feature Name

          Releases

          Feature Information

          IPv6 Policy-Based Routing

          15.2(2)E

          Policy-based routing for IPv6 allows a user to manually configure how received packets should be routed.

          In Cisco IOS Release 15.2(2)E, this feature was supported on the following platform:
          • Catalyst 2960-X Series Switches

          The following commands were introduced or modified: debug fm ipv6 pbr, debug ipv6 policy, ipv6 local policy route-map, ipv6 policy route-map, match ipv6 address, match length, route-map, set default interface, set interface, set ipv6 default next-hop, set ipv6 next-hop (PBR), set ipv6 precedence, set vrf, show fm ipv6 pbr all, show fm ipv6 pbr interface, show ipv6 policy, and show route-map.