PBR策略路由 如何做策略路由器 pbr策略路由和acl

一． 策略路由配置

1. 匹配数据包IP地址、前缀列表

Router(config)#route-map rp-name

Router(config-route-map)#match ip address {access-list-number|name} […access-list-number|name]|prefix-list prefix-list-name […prefix-list-name]

Router(config)#route-map TEST

Router(config-route-map)#match ip address 1

2. 匹配数据包大小

Router(config-route-map)#match length min max

3. 设定分组的下一跳IP（必须为直连IP）

Router(config-route-map)#set ip next-hop ip-address […ip-address]

Router(config-route-map)#set ip next-hop 10.1.12.2 10.1.13.3

4. 设定分组的出接口

Router(config-route-map)#set interface type number [?type number]

Router(config-route-map)#set interface fast 0/0

5. 应用PBR（对进入接口的数据流量生效，本地始发的流量无效）

Router(config-if)#ip policy route-map TEST

6. 应用PBR（针对本地始发的流量生效）

Router(config)# ip local policy route-map TEST

7. 查看PBR命令

Router#show ip policy

Router#show route-map [map-name]

二． 策略路由场景

1. 备份路径

GW(config)#access-list 1 permit any

GW(config)#route-map PBR permit 10

GW(config-route-map)#match ip address 1

GW(config-route-map)#set ip next-hop 10.1.1.2 10.2.2.2

2. 感知上游设备状态特性（两端都是思科设备，并均开启CDP）

GW(config)#access-list 1 permit any

GW(config)#route-map PBR permit 10

GW(config-route-map)#match ip address 1

GW(config-route-map)#set ip next-hop 10.1.1.2 10.2.2.2

GW(config-route-map)#set ip next-hop verify-availability

3. 感知上游设备状态特性（利用sla,无需思科和CDP）草稿，需完善

ip sla monitor responder

ip sla monitor 1

type echo protocol ipIcmpEcho 10.1.1.2 source-ipaddr 10.1.1.1

frequency 10

ip sla monitor schedule 1 life forever start-time now

track 1 rtr 1 reachability

GW(config)#access-list 1 permit any

GW(config-route-map)#route-map PBR permit 10

GW(config-route-map)#match ip address 1

GW(config-route-map)#set ip next-hop verify-availability 10.1.1.2 10 track 1

GW(config-route-map)#set ip next-hop verify-availability 10.2.2.2 20 track 2

4. Recursive 可达路径关键词

Recursive提供了一种非直连路径下一条（next-hop）的可能性，所指ip必须可达

GW(config)#access-list 1 permit any

GW(config)#route-map PBR permit 10

GW(config-route-map)#match ip address 1

GW(config-route-map)#set ip next-hop 10.2.2.2

GW(config-route-map)#set ip next-hop recursive 10.1.12.2

GW(config)#ip route 10.1.12.0 255.255.255.0 10.1.1.2

GW(config)#ip route 0.0.0.0 0.0.0.0 serial s0/2

三． 策略路由案例

1. 按流量选择路径（注意，之前一课的路由策略都是按路由分路径）

Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255

Router(config)#access-list 2 permit 192.168.2.0 0.0.0.255

Router(config)#route-map test permit 10

Router(config)#match ip address 1

Router(config-route-map)#set ip next-hop 10.1.1.2

Router(config)#route-map test permit 40

Router(config-route-map)#match ip address 2

Router(config-route-map)#set ip next-hop 10.2.2.2

Router(config)#int f0/0

Router(config-if)#ip policy route-map test

Router(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.2

Router(config)#ip route 0.0.0.0 0.0.0.0 10.2.2.2 10

2. Next-hop关键字，不带default，优先级高于明细路由

R1(config)#access-list 1 permit 10.1.1.0 0.0.0.255

R1(config)#route-map PBR permit 10

R1(config-route-map)#match ip address 1

R1(config-route-map)#set ip next-hop 10.1.13.3

R1(config)#int f0/0

R1(config-if)#ip policy route-map PBR

R1(config)#ip route 0.0.0.0 0.0.0.0 10.1.13.2

3. Next-hop，带default关键字，优先级低于明细路由

R1(config)#access-list 1 permit 10.1.1.0 0.0.0.255

R1(config)#route-map PBR permit 10

R1(config-route-map)#match ip address 1

R1(config-route-map)#set ip default next-hop 10.1.13.3

R1(config)#int f0/0

R1(config-if)#ip policy route-map PBR

R1(config)#ip route 10.1.23.0 255.255.255.0 10.1.12.2

4. NAT应用策略路由

GW(config)#access-list 1 permit 192.168.1.0 0.0.0.255

GW(config)#access-list 2 permit 192.168.2.0 0.0.0.255

GW(config)#route-map PBR permit 10

GW(config-route-map)#match ip address 1

GW(config-route-map)#set ip next-hop 11.1.1.2

GW(config)#route-map PBR permit 20

GW(config-route-map)#match ip address 2

GW(config-route-map)#set ip next-hop 22.2.2.2

GW(config)#route-map nat1 permit 10

GW(config-route-map)#match ip address 1

GW(config-route-map)#match interface serial0/0 !!匹配数据包的出口

GW(config)#route-map nat2 permit 10

GW(config-route-map)#match ip address 1

GW(config)#route-map nat3 permit 10

GW(config-route-map)#match ip address 2

GW(config-route-map)#match interface serial0/1

GW(config)#route-map nat4 permit 10

GW(config-route-map)#match ip address 2

GW(config)#ip nat inside source route-map nat1 interface serial0/0 overload

GW(config)#ip nat inside source route-map nat2 interface serial0/1 overload

GW(config)#ip nat inside source route-map nat3 interface serial0/1 overload

GW(config)#ip nat inside source route-map nat4 interface serial0/0 overload