Does icmp redirect work with policy based route
Setup:
R1 and R2 on same ip net.
On R1 policy based route is configured with R2 as next hop.
Will R1 send icmp redirect (to use R2 instead) to those hosts that match the policy based routing ?
Thanks.
Gert Schaarup
HI Gert,
The answer to your question is yes. I have verified this in a lab previously. As long as all the conditions for ICMP redirect have been met (source address on same net, best gateway on same net) then ICMP redirects are sent regardless of whether PBR or normal routing is being used.
Hope that helps - pls rate the post if it does.
Paresh
Similar Messages
-
Just as the question says
Does AirPrint work with all kinds of printers with moden usb capability.
AirPrint works if you have an AirPrint compatible printer. See this Apple support document for details on compatible models.
http://support.apple.com/kb/HT4356
If the printer is not AirPrint compatible, it still might be possible to enable printing by installing an App like Print Central on the iPad, iPhone, or iPod.
PrintCentral Pro for iPhone/iPod Touch - iTunes - Apple
Does it also work with android based devices?
I would be surprised if it did, but best to ask that question on an Android support forum. -
Does auto provisioning work with position based security
We are implementing GRC 5.3 and use position based security. I am able to run risk analysis for position based security but now we want to use CUP and push our roles to the positions. And finally we want to associate the user to the position. We want to do all of this through GRC. Is this possible?
Thanks!Peggy,
For this to work, click on the tab (on top) which says by system. Here you can set up autoprovisioning by system. If you have 5.2, I don't know if this is available or not but it is available in 5.3.
Regards,
Alpesh -
Ip helper address with Policy Base Routing
Does ip helper work with Policy Base Routing? and if so how and what version of the router software do you need?
thanksAs first function at the ingress interface is ip_helper, as second function at the same ingress interface is policy-based-routing.
We have the same situation regarding ip nat in combination with policy-based-routing. -
Policy based routing on a Layer 3 switch
I am doing some lab testing on policy based routing. I am having some issues that I can't see to get working right.
Here is the config:
ip local policy route-map Test-map
ip access-list extended icmp
permit icmp 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255
permit icmp 192.168.2.0 0.0.0.255 192.168.200.0 0.0.0.255
ip access-list extended telnet
permit tcp 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255 eq telnet
permit tcp 192.168.2.0 0.0.0.255 192.168.200.0 0.0.0.255 eq telnet
ip access-list extended test
permit icmp 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255
route-map Test-map permit 10
match ip address icmp
set ip next-hop 192.168.1.3
route-map Test-map permit 20
match ip address telnet
set ip next-hop 192.168.1.2
The first thing I did was I only had 1 network on this box the 192.168.1.x and when I plugged a pc into a port on the switch and tried to ping the remote network of 192.168.200.1 it will not hit on my access-lists for my policy based routes.
If I do a ping from the switches IOS interface directly the access-lists get hits and the policy based routes work fine.
So I was puzzled by this and figured maybe policy based routes only work if they come from one network to another network. So I setup a 2nd vlan called 192.168.2.x and put my pc in that vlan. I then proceed to ping 192.168.200.1 and still was unable to get any hits on the access-lits or policy based routes.
So what am I doing wrong or am I trying to use policy based routing wrong here?I've done that command but then when I do a "show run" I don't see it in the configuration and it doesn't seem to be working.
Also if everything is on the same vlan 100 will the pbr work? or does this require that I use two different vlans? (one for inside and one for outside) so that I have a interface from where the packets are coming from? -
Policy Based Routing with VPN Client configuration
Hi to all,
We have a Cisco 2800 router in our company that also serves as a VPN server. We use the VPN Client to connect to our corporate network (pls don't laugh, I know that it is very obsolete but I haven't had the time lately to switch to SSL VPN).
The router has two WAN connections. One is the primary wan ("slow wan" link with slower upload 10D/1U mbps) and it is used for the corporate workstations used by the emploees. The other is our backup link. It has higher upload speed - 11D/11U mbps, (fast wan), and thus we also use the high upload link for our webserver (I have done this using PBR just for the http traffic from the webserver). For numerous other reasions we can not use the `fast wan` connection as our primary connection and it is used anly as a failover in case the primary link fails.
The `fast wan` also has a static IP address and we use this static IP for the VPN Client configuration.
Now the thing is that because of the failover, when we connect from the outside using the VPN Client, the traffic comes from the`fast wan` interface, but exits from the `slow wan` interface. And because the `slow wan` has only 1mbps upload the vpn connection is slow.
Is there any way for us to redirect the vpn traffic to always use the `fast wan` interface and to take advantage of the 11mbps upload speed of that connection?
This is our sanitized config
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration group dc
key ***
dns 192.168.5.7
domain corp.local
pool SDM_POOL_1
acl 101
max-users 3
netmask 255.255.255.0
crypto isakmp profile sdm-ike-profile-1
match identity group dc
isakmp authorization list sdm_vpn_group_ml_1
client configuration address respond
virtual-template 1
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec profile SDM_Profile1
set security-association idle-time 3600
set transform-set ESP-3DES-SHA
set isakmp-profile sdm-ike-profile-1
interface Loopback0
ip address 10.10.10.1 255.255.255.0
interface FastEthernet0/0
description *WAN*
no ip address
ip mtu 1396
duplex auto
speed auto
interface FastEthernet0/0.3
description FAST-WAN-11D-11U
encapsulation dot1Q 3
ip address 88.XX.XX.75 255.255.255.248
ip load-sharing per-packet
ip nat outside
ip virtual-reassembly
interface FastEthernet0/0.4
description SLOW-WAN-10D-1U
encapsulation dot1Q 4
ip address dhcp
ip nat outside
ip virtual-reassembly
no cdp enable
interface FastEthernet0/1
description *LOCAL*
no ip address
ip virtual-reassembly
duplex auto
speed auto
interface FastEthernet0/1.10
description VLAN 10 192-168-5-0
encapsulation dot1Q 10
ip address 192.168.5.1 255.255.255.0
ip nat inside
ip virtual-reassembly max-reassemblies 32
no cdp enable
interface FastEthernet0/1.20
description VLAN 20 10-10-0-0
encapsulation dot1Q 20
ip address 10.10.0.254 255.255.255.0
ip access-group PERMIT-MNG out
ip nat inside
ip virtual-reassembly
!!! NOTE: This route map is used to PBR the http traffic for our server
ip policy route-map REDIRECT-VIA-FAST-WAN
no cdp enable
interface Virtual-Template1 type tunnel
ip unnumbered Loopback0
tunnel mode ipsec ipv4
tunnel protection ipsec profile SDM_Profile1
interface Virtual-Template3
no ip address
interface Virtual-Template4
no ip address
ip local pool SDM_POOL_1 192.168.5.150 192.168.5.152
ip forward-protocol nd
!!! SLOW-WAN NEXT HOP DEFAULT ADDRESS
ip route 0.0.0.0 0.0.0.0 89.XX.XX.1 5
!!! FAST-WAN NEXT HOP DEFAULT ADDRESS
ip route 0.0.0.0 0.0.0.0 88.XX.XX.73 10
ip nat inside source route-map FAST-WAN-NAT-RMAP interface FastEthernet0/0.3 overload
ip nat inside source route-map SLOW-WAN-NAT-RMAP interface FastEthernet0/0.4 overload
access-list 101 remark SDM_ACL Category=4
access-list 101 permit ip 192.168.5.0 0.0.0.255 any
access-list 101 permit ip 10.10.0.0 0.0.0.255 any
ip access-list extended FAST-WAN-NAT
permit tcp 192.168.5.0 0.0.0.255 range 1025 65535 any
permit udp 192.168.5.0 0.0.0.255 range 1025 65535 any
permit icmp 192.168.5.0 0.0.0.255 any
permit tcp 10.10.0.0 0.0.0.255 range 1025 65535 any
permit udp 10.10.0.0 0.0.0.255 range 1025 65535 any
permit icmp 10.10.0.0 0.0.0.255 any
ip access-list extended REDIRECT-VIA-FAST-WAN
deny tcp host 10.10.0.43 eq 443 9675 192.168.5.0 0.0.0.255
permit tcp host 10.10.0.43 eq 443 9675 any
ip access-list extended SLOW-WAN-NAT
permit ip 192.168.5.0 0.0.0.255 any
permit ip 10.10.0.0 0.0.0.255 any
route-map FAST-WAN-NAT-RMAP permit 10
match ip address FAST-WAN-NAT
match interface FastEthernet0/0.3
route-map REDIRECT-VIA-FAST-WAN permit 10
match ip address REDIRECT-VIA-FAST-WAN
set ip next-hop 88.XX.XX.73
route-map SLOW-WAN-NAT-RMAP permit 10
match ip address SLOW-WAN-NAT
match interface FastEthernet0/0.4Can you try to use PBR Match track object,
Device(config)# route-map abc
Device(config-route-map)# match track 2
Device(config-route-map)# end
Device# show route-map abc
route-map abc, permit, sequence 10
Match clauses:
track-object 2
Set clauses:
Policy routing matches: 0 packets, 0 bytes
Additional References for PBR Match Track Object
This feature is a part of IOS-XE release 3.13 and later.
PBR Match Track Object
Cisco IOS XE Release 3.13S
The PBR Match Track Object feature enables a device to track the stub object during Policy Based Routing.
The following commands were introduced or modified: match track tracked-obj-number
Cheers,
Sumit -
Does apple tv work with ee router
does apple tv work with my ee smartbox router
Doubtful.
What allows for streaming content from an iPad to a television thru an Apple TV is Apple software included with iOS on the iPad and the Apple TV software. Unless there is a 3rd party android app that provides for this, no. -
Policy based routing to host in same vlan/subnet
Hello i have nexus 7k that i have a policy based routing setup as follows for 2 vlans, 802 and 803, to set default route out to a host in vlan 802. i have applied my policy to the vlans and everything works fine for a host in vlan 803, it routes over and out properly. However when im in vlan 802 my host traffic never gets to 172.21.1.237 when pointed at the gateway 172.21.1.1. I can see the pbr statistics incrementing indicating that i am initially hitting the policy but im not sure where my traffic goes after that. I can talk to .237 direct in the vlan but i would like this to work through pbr to utilize all of my other routes and default gateway.
vlans 802
172.21.1.1/24
ip policy route-map West
vlan 803
172.21.17.1/24
ip policy route-map West
route-map West permit 10
match vlan 802-803
set ip default next-hop 172.21.1.237
Im thinking there is some kind of hairpinning problem or maybe im creating some kind of blackhole.
any help is appreciated.
thanks, scottScott
If the destination IP is in the same subnet as source IP then it won't be routed it will be L2 switched so it would never use the default gateway ie.
src IP 172.21.1.10 255.255.255.0
dst IP 172.21.1.237 255.255.255.0
src compares it's own IP with it's subnet mask and sees it is on the 172.21.1.x network. src then compares the destination IP with it's own subnet mask and sees it is also on the 172.21.1.x network so it simply arps out for that address and when it gets the mac address it sends it direct to the destination. It would only use the default gateway if the destination IP was on a different network.
So i don't see how you will be able to do this and i'm not sure why you are seeing hits in your PBR acl for the host in the 172.21.1.x network.
Edit - what exactly do you mean when you say -
However when im in vlan 802 my host traffic never gets to 172.21.1.237 when pointed at the gateway 172.21.1.1.
How are you doing this ie. pointing it to the default gateway because as i say it should always be able to communicate with 172.21.1.237 as it is in the same subnet.
Jon -
WSA and Cisco Policy Based Routing
I'm looking to convert my WSA from explicit to transparent proxy using policy based routing on a Cisco router. See the config below where xxx.xxx.xxx.xxx is the P1 interface on the WSA. Does anyone see any issues with the following in a production environment?
access-list 110 permit tcp any any eq www
route-map proxy-redirect permit 10
match ip address 110
set ip next-hop xxx.xxx.xxx.xxx
interface ethernet0/1
ip policy route-map proxy-redirect
The P1 interface on the WSA is located upstream from the router so I'm not checking for it in the ACL.That router configuration looks good to me, but just make sure that the WSA was configured for Transparent mode during the initial System Setup Wizard configuration. If it was initially configured for explicit only, then you will need to run the wizard again to change it to transparent.
Also, make sure to add a deny statement to the top of access-list 110 for the WSA IP address if the WSA will be going out to the Internet through the same e0/1 interface. Loops are bad. :twisted:
Cheers,
Jason -
Policy based routing on VRF interfaces to route traffic through TE Tunnel
Hi All,
Is there a method to do policy based routing on VRF interfaces and route data traffic through one TE tunnel and non-data traffic through another TE tunnel.
The tunnel is already build up with these below config
interface Tunnel25
ip unnumbered Loopback0
tunnel destination 10.250.16.250
tunnel mode mpls traffic-eng
tunnel mpls traffic-eng path-option 10 explicit name test
ip explicit-path name test enable
next-address x.x.x.x
next-address y.y.y.y
router ospf 1
mpls traffic-eng router-id Loopback0
mpls traffic-eng area 0
mpls traffic-eng tunnels
nterface GigabitEthernet5/2
mpls traffic-eng tunnels
mpls ip
Is there additional config needed to work ,also in the destination end for the return traffic,we want to use the normal PATH --I mean non TE tunnel.
We tested with the above scenario,but couldn't able to reach the destination.Meantime we had a question,when the packet uses the policy map while ingress,it may not know the associatuion with VRF(Is that right? --If so ,how to make it happen)
Any help would be really appreciated
Thanks
Regards
Anantha Subramanian Natarajanhi Anantha!
I might not be the right person to comment on your first question. I have not configured MVPNs yet and not very confertable with the topic.
But I am sure that if you read through the CBTS doc thoroughly, you might be able to derive the answer yourself. One thing I notice is that " a Tunnel will be selected regularly according to the routing process (even isf it is cbts enabled). From the tunnels selected using the regular best path selection, the traffic is mapped to a perticular tunnel in the group if specific class is mapped to that tunnel.
So a master tunnel can be the only tunnel between the 2 devices over which the routing (bgp next hops) are exchanged and all other tunnels can be members of this tunnel. So your RPF might not fail.
You might have to explore on this a bit more and read about the co-existance of multicast and TE. This will be the same as that.
For your second question, the answer would be easy :
If you want a specific eompls cust to take a particular tunnel/path, just create a seperate pair of loopbacks on the PEs. Make the loopback learnt on the remote PE through the tunnel/path that you want the eompls to take. Then establish the xconnect with this loopback. I am assuming that your question is that a particular eompls session should take a particular path.
If you meant that certain traffic from the same eompls session take a different path/tunnel, then CBTS will work.
Regards,
Niranjan -
Introduce second default gateway into policy-based routing and optimization
Questions:
1) How to get the second PBR_DEFAULT_GATEWAY address 10.20.20.3 into the policy-based routing for redundancy?
2) Any optimizations as more and more traffic (policy-based routed and otherwise) goes through interface Gi1/0/1?
Address range A.B.0.0/16 represents assigned Internet-routable addresses.
Network also uses 10.0.0.0/8, 172.16.0.0/20, 192.168.0.0/16.
DEFAULT_GATEWAY router participates in OSPF and injects the default routes 0.0.0.0/0 10.10.10.1 and 0.0.0.0/0 10.20.20.1 into OSPF.
PBR_DEFAULT_GATEWAY router participates in OSPF but filters out default routes injected by DEFAULT_GATEWAY router.
ROUTER_A participates in OSPF and receives default routes injected by DEFAULT_GATEWAY router.
ROUTER_A contains the attached policy-routing configuration that allows the subnet A.B.30.0/24 to route anywhere on the network and uses PBR_DEFAULT_GATEWAY as the way out.Ok I will see if I can run out to work and try this today..
After thinking about this, If I need to get to local ip addresses (192.168.1.0 and 192.168.128.0), I might have to change my route map to include those ranges in an ACL, then assign the 172.20.200.1 as the gateway to get to those networks, with the last statement being the traffic to be sent out the firewall
for instance
# Access to one of my local networks
access-list 101 permit ip 172.20.200.0 0.0.0.255 192.168.1.0 0.0.0.255
# Send Internet traffic to ASA/PIX
access-list 172 permit ip 172.20.200.0 0.0.0.255 any
route-map pix-172-20-200 permit 10
match ip address 101
set ip next-hop 172.20.200.1
route-map pix-172-20-200 permit 20
match ip address 172
set ip next-hop 172.20.200.2
and so on?
I know I need to be in front of my switch to test the change from set ip default next-hop to set ip next-hop...
I wantto make sure I can still get to the local networks I need to get to.
I appreciate all your help, and I will test this later on today..
Thanks
Don Hickey -
SRP527-U Policy Based Routing To Squid?
Hi,
I have a SRP527-U running 1.2.6.
I have a simple setup, a ADSL connection to the Internet and a bunch of PC's behind that with Internet access.
I've setup a host on the same VLAN as the other devices and I've set it up running squid.
What I'd like to do is use the Policy Based Routing function to force all users trying to browse the Internet through that squid instance.
That is
Source of 192.168.0.20/32 Port 80 -> Policy Based Route to Destination of 192.168.0.50 port 3128
Is that possible with this device, or is that outside of its capabilities? I've looked at the PBR section, but it seems to imply forcing all traffic out through a WAN Interface which isn't what I want to achieve.
Kind Regards,
TimScott
If the destination IP is in the same subnet as source IP then it won't be routed it will be L2 switched so it would never use the default gateway ie.
src IP 172.21.1.10 255.255.255.0
dst IP 172.21.1.237 255.255.255.0
src compares it's own IP with it's subnet mask and sees it is on the 172.21.1.x network. src then compares the destination IP with it's own subnet mask and sees it is also on the 172.21.1.x network so it simply arps out for that address and when it gets the mac address it sends it direct to the destination. It would only use the default gateway if the destination IP was on a different network.
So i don't see how you will be able to do this and i'm not sure why you are seeing hits in your PBR acl for the host in the 172.21.1.x network.
Edit - what exactly do you mean when you say -
However when im in vlan 802 my host traffic never gets to 172.21.1.237 when pointed at the gateway 172.21.1.1.
How are you doing this ie. pointing it to the default gateway because as i say it should always be able to communicate with 172.21.1.237 as it is in the same subnet.
Jon -
Hello,
I am setting up PBR. Looking at my configuration, will the next hop apply for both access lists 100 and 101? or will access-list 101 use 192.168.0.1 as the next up? I was hoping acl 101 will use 10.10.10.1 as next up.
router configuration:
route-map policy-based-routing permit 10
match ip address 100
set ip next-hop 192.168.10.1
route-map policy-based-routing permit 20
match ip address 101
set ip next-hop 10.10.10.1
access-list 100 permit ip 10.10.10.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 100 deny ip 10.10.10.0 0.0.0.255 any
access-list 101 permit ip 10.10.10.0 0.0.0.255 any
access-list 101 deny ip any any
ip route 0.0.0.0 0.0.0.0 10.10.10.1Paul,
All you need is the following configuration.
route-map policy-based-routing permit 10
match ip address 100
set ip next-hop 192.168.10.1
access-list 100 permit ip 10.10.10.0 0.0.0.255 192.168.10.0 0.0.0.255
ip route 0.0.0.0 0.0.0.0 10.10.10.1
with the above configuration applied to the correct incoming interface, all traffic from 10.10.10.0 destined to 192.168.10.0 will use the next hop from the route map and all other traffic wil use the default route
HTH
Narayan -
Photosmart C4780 won't work with my new router.
Hi
I have been sent a new plusnet TG582n router after my old one broke and now my wireless printer won't work.
I have tried uninstalling the software and connecting the printer via USB to reinstall on my windows 7 netbook but it came up with drivers failed to install.
On my windows 8.1 laptop I have uninstalled and reinstalled and this was unable to complete. I have now done a restore to a previous setting on both of them so the software and drivers are still on.
I have tried connecting my printer via USB cable but this tries to install the software again.
If I go into devices my printer shows up with error and won't print.
After trying all this I have now done a restore on the printer to factore settings (also trying the uninstall and reinstall via USB after this) and it still won't work.
After doing a wireless test report it came up with my old ssid initially even after installing my new router which has a new ssid. After resetting the printer it now comes up with SigmaplusEOL1. It shows on the report that wirelss is on and working but ssid fail.
I don't know what else to try as I have spent hours tyring different things and done trouble shooting several times.
I have also been told by plusnet that t he routershould work for wireless n or wireless g.
Please help!Hi Tazza,
Welcome to the HP Forums! I understand that your HP Photosmart C4780, will not work with your new router. I am happy to help you with this! I believe these following guides should help:
The Printer is Not Found During Wireless Network Installation in Windows.
Printer Does Not Maintain Wireless Connection.
Just to make sure the hardware is functional, can you make copies standalone with the printer? Or what happens when you print a status report? Video of Printing a status report.
Hope to hear from you, and thank you for posting!
RnRMusicMan
I work on behalf of HP
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos Thumbs Up" to say “Thanks” for helping! -
Does time machine work with the trash folder?
Does time machine work with the trash folder? So if I have the entire aperture library backed up to the time machine. Is it safe to empty the trash folder in aperture? I am able to recover files from time machine later?
So make a top-level Project called "_Circular File". Put Images in there that you what to have out of your way but not discarded.
It really is good and proper to treat the Trash as trash. I instruct everyone to _empty_ the Aperture Trash at the end of _every_ session. The reason is this: it is the only time you will remember whether it is safe to delete the items in there. If you wait, you will then waste time trying to answer "Did I really mean to throw that out?" or, periodically, you'll give up trying to remember, and will empty the Trash without reviewing it. At the end of every session, examine the Trash, confirm that the items there are trash, and empty it.
Shocking, perhaps, but you should also empty your system trash every day. The real-life equivalents are good guides here. No-one in an office hoards their trash. If you mean to throw something out, throw it out. If you don't mean to throw it out, do not put it in the trash.
I don't know how TM handles the Aperture Trash. I do know, however, that I would not expect this behavior to remain consistent, and would absolutely recommend against a workflow based on it.
Maybe you are looking for
-
I have bought a shiny new desktop PC with Windows 8.1. It does not permit POP3 email providers. My current email provider does not support IMAP (it is a freeserve.co.uk address from orange.co.uk also known as EE). I have had my email address for 16 y
-
trying to download the trial version of acrobat pro dc.The installer's says downloading but it's stuck with 3% for the last 30 minutes. What to do?
-
I had bt infinity installed on the 30/03/2012 I could not check my speed on the day of installation as I did not have a long enough ethernet cable (which I now have) and was also not wifi connected (which I now am). When i finally connected my comput
-
Last published field in odata reports
hi folks, We are using Project OnLine and we want to implement a safe Timesheet reporting in order to invoice customers correctly. I tried to create an oData report which display the Last published date and the last Modified date for each project,
-
Is the "update Genius" option gone?
Didn't iTunes used to have a menu item that you could click on, to update Genius? I'm using the latest on Mac Lion, and most of my iTunes songs, some are popular , get the Genius message that that song is not in the database.