PBR策略路由(如何做策略路由器)
一． 策略路由配置
1. 匹配數據包IP地址、前綴列表
Router(config)#route-map rp-name
Router(config-route-map)#match ip address {access-list-number|name} […access-list-number|name]|prefix-list prefix-list-name […prefix-list-name]
Router(config)#route-map TEST
Router(config-route-map)#match ip address 1
2. 匹配數據包大小
Router(config-route-map)#match length min max
3. 設定分組的下一跳IP（必須為直連IP）
Router(config-route-map)#set ip next-hop ip-address […ip-address]
Router(config-route-map)#set ip next-hop 10.1.12.2 10.1.13.3
4. 設定分組的出接口
Router(config-route-map)#set interface type number [?type number]
Router(config-route-map)#set interface fast 0/0
5. 應用PBR（對進入接口的數據流量生效，本地始發的流量無效）
Router(config-if)#ip policy route-map TEST
6. 應用PBR（針對本地始發的流量生效）
Router(config)# ip local policy route-map TEST
7. 查看PBR命令
Router#show ip policy
Router#show route-map [map-name]
二． 策略路由場景
1. 備份路徑
GW(config)#access-list 1 permit any
GW(config)#route-map PBR permit 10
GW(config-route-map)#match ip address 1
GW(config-route-map)#set ip next-hop 10.1.1.2 10.2.2.2
2. 感知上游設備狀態特性（兩端都是思科設備，并均開啟CDP）
GW(config)#access-list 1 permit any
GW(config)#route-map PBR permit 10
GW(config-route-map)#match ip address 1
GW(config-route-map)#set ip next-hop 10.1.1.2 10.2.2.2
GW(config-route-map)#set ip next-hop verify-availability
3. 感知上游設備狀態特性（利用sla,無需思科和CDP）草稿，需完善
ip sla monitor responder
ip sla monitor 1
type echo protocol ipIcmpEcho 10.1.1.2 source-ipaddr 10.1.1.1
frequency 10
ip sla monitor schedule 1 life forever start-time now
track 1 rtr 1 reachability
GW(config)#access-list 1 permit any
GW(config-route-map)#route-map PBR permit 10
GW(config-route-map)#match ip address 1
GW(config-route-map)#set ip next-hop verify-availability 10.1.1.2 10 track 1
GW(config-route-map)#set ip next-hop verify-availability 10.2.2.2 20 track 2
4. Recursive 可達路徑關鍵詞
Recursive提供了一種非直連路徑下一條（next-hop）的可能性，所指ip必須可達
GW(config)#access-list 1 permit any
GW(config)#route-map PBR permit 10
GW(config-route-map)#match ip address 1
GW(config-route-map)#set ip next-hop 10.2.2.2
GW(config-route-map)#set ip next-hop recursive 10.1.12.2
GW(config)#ip route 10.1.12.0 255.255.255.0 10.1.1.2
GW(config)#ip route 0.0.0.0 0.0.0.0 serial s0/2
三． 策略路由案例
1. 按流量選擇路徑（注意，之前一課的路由策略都是按路由分路徑）
Router(config)#access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)#access-list 2 permit 192.168.2.0 0.0.0.255
Router(config)#route-map test permit 10
Router(config)#match ip address 1
Router(config-route-map)#set ip next-hop 10.1.1.2
Router(config)#route-map test permit 40
Router(config-route-map)#match ip address 2
Router(config-route-map)#set ip next-hop 10.2.2.2
Router(config)#int f0/0
Router(config-if)#ip policy route-map test
Router(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.2
Router(config)#ip route 0.0.0.0 0.0.0.0 10.2.2.2 10
2. Next-hop關鍵字，不帶default，優先級高于明細路由
R1(config)#access-list 1 permit 10.1.1.0 0.0.0.255
R1(config)#route-map PBR permit 10
R1(config-route-map)#match ip address 1
R1(config-route-map)#set ip next-hop 10.1.13.3
R1(config)#int f0/0
R1(config-if)#ip policy route-map PBR
R1(config)#ip route 0.0.0.0 0.0.0.0 10.1.13.2
3. Next-hop，帶default關鍵字，優先級低于明細路由
R1(config)#access-list 1 permit 10.1.1.0 0.0.0.255
R1(config)#route-map PBR permit 10
R1(config-route-map)#match ip address 1
R1(config-route-map)#set ip default next-hop 10.1.13.3
R1(config)#int f0/0
R1(config-if)#ip policy route-map PBR
R1(config)#ip route 10.1.23.0 255.255.255.0 10.1.12.2
4. NAT應用策略路由
GW(config)#access-list 1 permit 192.168.1.0 0.0.0.255
GW(config)#access-list 2 permit 192.168.2.0 0.0.0.255
GW(config)#route-map PBR permit 10
GW(config-route-map)#match ip address 1
GW(config-route-map)#set ip next-hop 11.1.1.2
GW(config)#route-map PBR permit 20
GW(config-route-map)#match ip address 2
GW(config-route-map)#set ip next-hop 22.2.2.2
GW(config)#route-map nat1 permit 10
GW(config-route-map)#match ip address 1
GW(config-route-map)#match interface serial0/0 !!匹配數據包的出口
GW(config)#route-map nat2 permit 10
GW(config-route-map)#match ip address 1
GW(config)#route-map nat3 permit 10
GW(config-route-map)#match ip address 2
GW(config-route-map)#match interface serial0/1
GW(config)#route-map nat4 permit 10
GW(config-route-map)#match ip address 2
GW(config)#ip nat inside source route-map nat1 interface serial0/0 overload
GW(config)#ip nat inside source route-map nat2 interface serial0/1 overload
GW(config)#ip nat inside source route-map nat3 interface serial0/1 overload
GW(config)#ip nat inside source route-map nat4 interface serial0/0 overload
