So it's that time again for me to renew my Cisco Certifications. As a result, this is be based on my preparation for the CCNP Route Exam (300-101).
In this post I will be focusing on Configuring and Verifying Policy Based Routing
Why would you wish to use Policy Based Routing? Let's say you have two Internet links from your office. One can be used for Web based traffic (HTTP, DNS, etc) while the other can be used for management traffic to your remote networks (Telnet, SSH, SNMP, ICMP, etc)
For the purposes of this lab, I will send all Telnet, ICMP and SSH (Management Traffic) traffic through ISP2 and all HTTP and DNS (Web) traffic through ISP1
This topology consists of one 2 ISPs, 1 Internet and 1 local_site
- Interface e1/0 - connected to ISP1 - IP 18.104.22.168/24
- Interface e1/1 - connected to ISP2 - IP 22.214.171.124/24
- Interface lo3 - INTERNET ADDRESS - IP 126.96.36.199/32
- Interface e1/0 - connected to ISP1 - IP 188.8.131.52/24
- Interface e1/1 - connected to ISP2 - IP 184.108.40.206/24
- Interface e1/0 - connected to ISP1 - IP 220.127.116.11/24
- Interface e1/1 - connected to ISP2 - IP 18.104.22.168/24
- Interface e1/0 - connected to ISP2 - IP 22.214.171.124/24
- Interface e1/1 - connected to ISP1 - IP 126.96.36.199/24
- Interface fa0/0 - connected to LAN - IP 10.0.0.1/32
Kali Host on Branch
eth0 - 10.0.0.2.2/24
Default Gateway - 10.0.0.1
Now that the interfaces are configured, it's time to configure the access lists.
Route Map config
Let's verify the route-map is assigned to an interface.
Now that the configs are finished, time to verify if the system is working as expected.
Verification - ICMP
For ICMP, I will do a manual traceroute, to verify that ICMP traffic is going through ISP2.
Ping with TTL set to 1
From above, we've successfully hit our own gateway
Ping with TTL set to 2
As we can see above, ICMP traffic is going through ISP-2
Ping with TTL set to 3
As can be seen from above, ICMP traffic successfully got to 188.8.131.52 (Internet)
Let's Verify the rest of the traffic to pass through ISP-2 (Telnet, SSH)
Looks good, SSH traffic is going through ISP-2 (184.108.40.206)
Looks good too, Telnet traffic is going through ISP-2 (220.127.116.11)
Now let's look at HTTP and DNS for ISP-1
Niceee! Just what we wanted to see HTTP traffic is going through ISP-1 (18.104.22.168)
Yep! DNS traffic is also flowing through ISP-1 (22.214.171.124)
Now that we have all of that, let's go back to the router to see what is logged.
Above we see the Management Traffic (port 22) being permitted
Above we see the Web Traffic (port 80) being permitted
Checking the counters of the access lists
Above, we see statistics from the access-lists showing the amount of traffic being logged and or denied.
Checking the counters of the route-map
Above we see statistics which shows the traffic is being processed by the route-map
That's it for configuring and verifying policy based routing.
Hope you enjoyed.