Does icmp redirect work with policy based route

Setup:
R1 and R2 on same ip net.
On R1 policy based route is configured with R2 as next hop.
Will R1 send icmp redirect (to use R2 instead) to those hosts that match the policy based routing ?
Thanks.
Gert Schaarup

HI Gert,
The answer to your question is yes. I have verified this in a lab previously. As long as all the conditions for ICMP redirect have been met (source address on same net, best gateway on same net) then ICMP redirects are sent regardless of whether PBR or normal routing is being used.
Hope that helps - pls rate the post if it does.
Paresh

Similar Messages

  • Does AirPrint work with all kinds of printers with modern usb capability? Does it also work with android based devices?

    Just as the question says

    Does AirPrint work with all kinds of printers with moden usb capability.
    AirPrint works if you have an AirPrint compatible printer.  See this Apple support document for details on compatible models.
    http://support.apple.com/kb/HT4356
    If the printer is not AirPrint compatible, it still might be possible to enable printing by installing an App like Print Central on the iPad, iPhone, or iPod.
    PrintCentral Pro for iPhone/iPod Touch - iTunes - Apple
    Does it also work with android based devices?
    I would be surprised if it did, but best to ask that question on an Android support forum.

  • Does auto provisioning work with position based security

    We are implementing GRC 5.3 and use position based security.  I am able to run risk analysis for position based security but now we want to use CUP and push our roles to the positions.  And finally we want to associate the user to the position.  We want to do all of this through GRC.  Is this possible?
    Thanks!

    Peggy,
       For this to work, click on the tab (on top) which says by system. Here you can set up autoprovisioning by system. If you have 5.2, I don't know if this is available or not but it is available in 5.3.
    Regards,
    Alpesh

  • Ip helper address with Policy Base Routing

    Does ip helper work with Policy Base Routing? and if so how and what version of the router software do you need?
    thanks

    As first function at the ingress interface is ip_helper, as second function at the same ingress interface is policy-based-routing.
    We have the same situation regarding ip nat in combination with policy-based-routing.

  • Policy based routing on a Layer 3 switch

    I am doing some lab testing on policy based routing. I am having some issues that I can't see to get working right.
    Here is the config:
    ip local policy route-map Test-map
    ip access-list extended icmp
    permit icmp 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255
    permit icmp 192.168.2.0 0.0.0.255 192.168.200.0 0.0.0.255
    ip access-list extended telnet
    permit tcp 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255 eq telnet
    permit tcp 192.168.2.0 0.0.0.255 192.168.200.0 0.0.0.255 eq telnet
    ip access-list extended test
    permit icmp 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255
    route-map Test-map permit 10
    match ip address icmp
    set ip next-hop 192.168.1.3
    route-map Test-map permit 20
    match ip address telnet
    set ip next-hop 192.168.1.2
    The first thing I did was I only had 1 network on this box the 192.168.1.x and when I plugged a pc into a port on the switch and tried to ping the remote network of 192.168.200.1 it will not hit on my access-lists for my policy based routes.
    If I do a ping from the switches IOS interface directly the access-lists get hits and the policy based routes work fine.
    So I was puzzled by this and figured maybe policy based routes only work if they come from one network to another network. So I setup a 2nd vlan called 192.168.2.x and put my pc in that vlan. I then proceed to ping 192.168.200.1 and still was unable to get any hits on the access-lits or policy based routes.
    So what am I doing wrong or am I trying to use policy based routing wrong here?

    I've done that command but then when I do a "show run" I don't see it in the configuration and it doesn't seem to be working.
    Also if everything is on the same vlan 100 will the pbr work? or does this require that I use two different vlans? (one for inside and one for outside) so that I have a interface from where the packets are coming from?

  • Policy Based Routing with VPN Client configuration

    Hi to all,
    We have a Cisco 2800 router in our company that also serves as a VPN server. We use the VPN Client to connect to our corporate network (pls don't laugh, I know that it is very obsolete but I haven't had the time lately to switch to SSL VPN).
    The router has two WAN connections. One is the primary wan ("slow wan" link with slower upload 10D/1U mbps) and it is used for the corporate workstations used by the emploees. The other is our backup link. It has higher upload speed - 11D/11U mbps, (fast wan), and thus we also use the high upload link for our webserver (I have done this using PBR just for the http traffic from the webserver). For numerous other reasions we can not use the `fast wan` connection as our primary connection and it is used anly as a failover in case the primary link fails.
    The `fast wan` also has a static IP address and we use this static IP for the VPN Client configuration.
    Now the thing is that because of the failover, when we connect from the outside using the VPN Client, the traffic comes from the`fast wan` interface, but exits from the `slow wan` interface. And because the `slow wan` has only 1mbps upload the vpn connection is slow.
    Is there any way for us to redirect the vpn traffic to always use the `fast wan` interface and to take advantage of the 11mbps upload speed of that connection?
    This is our sanitized config
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp client configuration group dc
    key ***
    dns 192.168.5.7
    domain corp.local
    pool SDM_POOL_1
    acl 101
    max-users 3
    netmask 255.255.255.0
    crypto isakmp profile sdm-ike-profile-1
       match identity group dc
       isakmp authorization list sdm_vpn_group_ml_1
       client configuration address respond
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec profile SDM_Profile1
    set security-association idle-time 3600
    set transform-set ESP-3DES-SHA
    set isakmp-profile sdm-ike-profile-1
    interface Loopback0
    ip address 10.10.10.1 255.255.255.0
    interface FastEthernet0/0
    description *WAN*
    no ip address
    ip mtu 1396
    duplex auto
    speed auto
    interface FastEthernet0/0.3
    description FAST-WAN-11D-11U
    encapsulation dot1Q 3
    ip address 88.XX.XX.75 255.255.255.248
    ip load-sharing per-packet
    ip nat outside
    ip virtual-reassembly
    interface FastEthernet0/0.4
    description SLOW-WAN-10D-1U
    encapsulation dot1Q 4
    ip address dhcp
    ip nat outside
    ip virtual-reassembly
    no cdp enable
    interface FastEthernet0/1
    description *LOCAL*
    no ip address
    ip virtual-reassembly
    duplex auto
    speed auto
    interface FastEthernet0/1.10
    description VLAN 10 192-168-5-0
    encapsulation dot1Q 10
    ip address 192.168.5.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly max-reassemblies 32
    no cdp enable
    interface FastEthernet0/1.20
    description VLAN 20 10-10-0-0
    encapsulation dot1Q 20
    ip address 10.10.0.254 255.255.255.0
    ip access-group PERMIT-MNG out
    ip nat inside
    ip virtual-reassembly
    !!! NOTE: This route map is used to PBR the http traffic for our server
    ip policy route-map REDIRECT-VIA-FAST-WAN
    no cdp enable
    interface Virtual-Template1 type tunnel
    ip unnumbered Loopback0
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile SDM_Profile1
    interface Virtual-Template3
    no ip address
    interface Virtual-Template4
    no ip address
    ip local pool SDM_POOL_1 192.168.5.150 192.168.5.152
    ip forward-protocol nd
    !!! SLOW-WAN NEXT HOP DEFAULT ADDRESS
    ip route 0.0.0.0 0.0.0.0 89.XX.XX.1 5
    !!! FAST-WAN NEXT HOP DEFAULT ADDRESS
    ip route 0.0.0.0 0.0.0.0 88.XX.XX.73 10
    ip nat inside source route-map FAST-WAN-NAT-RMAP interface FastEthernet0/0.3 overload
    ip nat inside source route-map SLOW-WAN-NAT-RMAP interface FastEthernet0/0.4 overload
    access-list 101 remark SDM_ACL Category=4
    access-list 101 permit ip 192.168.5.0 0.0.0.255 any
    access-list 101 permit ip 10.10.0.0 0.0.0.255 any
    ip access-list extended FAST-WAN-NAT
    permit tcp 192.168.5.0 0.0.0.255 range 1025 65535 any
    permit udp 192.168.5.0 0.0.0.255 range 1025 65535 any
    permit icmp 192.168.5.0 0.0.0.255 any
    permit tcp 10.10.0.0 0.0.0.255 range 1025 65535 any
    permit udp 10.10.0.0 0.0.0.255 range 1025 65535 any
    permit icmp 10.10.0.0 0.0.0.255 any
    ip access-list extended REDIRECT-VIA-FAST-WAN
    deny   tcp host 10.10.0.43 eq 443 9675 192.168.5.0 0.0.0.255
    permit tcp host 10.10.0.43 eq 443 9675 any
    ip access-list extended SLOW-WAN-NAT
    permit ip 192.168.5.0 0.0.0.255 any
    permit ip 10.10.0.0 0.0.0.255 any
    route-map FAST-WAN-NAT-RMAP permit 10
    match ip address FAST-WAN-NAT
    match interface FastEthernet0/0.3
    route-map REDIRECT-VIA-FAST-WAN permit 10
    match ip address REDIRECT-VIA-FAST-WAN
    set ip next-hop 88.XX.XX.73
    route-map SLOW-WAN-NAT-RMAP permit 10
    match ip address SLOW-WAN-NAT
    match interface FastEthernet0/0.4

    Can you try to use PBR Match track object,
    Device(config)# route-map abc
    Device(config-route-map)# match track 2
    Device(config-route-map)# end
    Device# show route-map abc
    route-map abc, permit, sequence 10
      Match clauses:
        track-object 2
      Set clauses:
      Policy routing matches: 0 packets, 0 bytes
    Additional References for PBR Match Track Object
    This feature is a part of IOS-XE release 3.13 and later.
    PBR Match Track Object
    Cisco IOS XE Release 3.13S
    The PBR Match Track Object feature enables a device to track the stub object during Policy Based Routing.
    The following commands were introduced or modified: match track tracked-obj-number
    Cheers,
    Sumit

  • Does apple tv work with ee router

    does apple tv work with my ee smartbox router

    Doubtful.
    What allows for streaming content from an iPad to a television thru an Apple TV is Apple software included with iOS on the iPad and the Apple TV software. Unless there is a 3rd party android app that provides for this, no.

  • Policy based routing to host in same vlan/subnet

    Hello i have nexus 7k that i have a policy based routing setup as follows for 2 vlans, 802 and 803, to set default route out to a host in vlan 802. i have applied my policy to the vlans and everything works fine for a host in vlan 803, it routes over and out properly. However when im in vlan 802 my host traffic never gets to 172.21.1.237 when pointed at the gateway 172.21.1.1. I can see the pbr statistics incrementing indicating that i am initially hitting the policy but im not sure where my traffic goes after that. I can talk to .237 direct in the vlan but i would like this to work through pbr to utilize all of my other routes and default gateway.
    vlans 802
    172.21.1.1/24
    ip policy route-map West
    vlan 803
    172.21.17.1/24
    ip policy route-map West
    route-map West permit 10
      match vlan 802-803
      set ip default next-hop 172.21.1.237
    Im thinking there is some kind of hairpinning problem or maybe im creating some kind of blackhole.
    any help is appreciated.
    thanks, scott

    Scott
    If the destination IP is in the same subnet as source IP then it won't be routed it will be L2 switched so it would never use the default gateway ie.
    src IP 172.21.1.10 255.255.255.0
    dst IP 172.21.1.237 255.255.255.0
    src compares it's own IP with it's subnet mask and sees it is on the 172.21.1.x network. src then compares the destination IP with it's own subnet mask and sees it is also on the 172.21.1.x network so it simply arps out for that address and when it gets the mac address it sends it direct to the destination. It would only use the default gateway if the destination IP was on a different network.
    So i don't see how you will be able to do this and i'm not sure why you are seeing hits in your PBR acl for the host in the 172.21.1.x network.
    Edit - what exactly do you mean when you say -
    However when im in vlan 802 my host traffic never gets to 172.21.1.237 when pointed at the gateway 172.21.1.1.
    How are you doing this ie. pointing it to the default gateway because as i say it should always be able to communicate with 172.21.1.237 as it is in the same subnet.
    Jon

  • WSA and Cisco Policy Based Routing

    I'm looking to convert my WSA from explicit to transparent proxy using policy based routing on a Cisco router. See the config below where xxx.xxx.xxx.xxx is the P1 interface on the WSA. Does anyone see any issues with the following in a production environment?
    access-list 110 permit tcp any any eq www
    route-map proxy-redirect permit 10
    match ip address 110
    set ip next-hop xxx.xxx.xxx.xxx
    interface ethernet0/1
    ip policy route-map proxy-redirect
    The P1 interface on the WSA is located upstream from the router so I'm not checking for it in the ACL.

    That router configuration looks good to me, but just make sure that the WSA was configured for Transparent mode during the initial System Setup Wizard configuration. If it was initially configured for explicit only, then you will need to run the wizard again to change it to transparent.
    Also, make sure to add a deny statement to the top of access-list 110 for the WSA IP address if the WSA will be going out to the Internet through the same e0/1 interface. Loops are bad. :twisted:
    Cheers,
    Jason

  • Policy based routing on VRF interfaces to route traffic through TE Tunnel

    Hi All,
    Is there a method to do policy based routing on VRF interfaces and route data traffic through one TE tunnel and non-data traffic through another TE tunnel.
    The tunnel is already build up with these below config
    interface Tunnel25
    ip unnumbered Loopback0
    tunnel destination 10.250.16.250
    tunnel mode mpls traffic-eng
    tunnel mpls traffic-eng path-option 10 explicit name test
    ip explicit-path name test enable
    next-address x.x.x.x
    next-address y.y.y.y
    router ospf 1
    mpls traffic-eng router-id Loopback0
    mpls traffic-eng area 0
    mpls traffic-eng tunnels
    nterface GigabitEthernet5/2
    mpls traffic-eng tunnels
    mpls ip
    Is there additional config needed to work ,also in the destination end for the return traffic,we want to use the normal PATH --I mean non TE tunnel.
    We tested with the above scenario,but couldn't able to reach the destination.Meantime we had a question,when the packet uses the policy map while ingress,it may not know the associatuion with VRF(Is that right? --If so ,how to make it happen)
    Any help would be really appreciated
    Thanks
    Regards
    Anantha Subramanian Natarajan

    hi Anantha!
    I might not be the right person to comment on your first question. I have not configured MVPNs yet and not very confertable with the topic.
    But I am sure that if you read through the CBTS doc thoroughly, you might be able to derive the answer yourself. One thing I notice is that " a Tunnel will be selected regularly according to the routing process (even isf it is cbts enabled). From the tunnels selected using the regular best path selection, the traffic is mapped to a perticular tunnel in the group if specific class is mapped to that tunnel.
    So a master tunnel can be the only tunnel between the 2 devices over which the routing (bgp next hops) are exchanged and all other tunnels can be members of this tunnel. So your RPF might not fail.
    You might have to explore on this a bit more and read about the co-existance of multicast and TE. This will be the same as that.
    For your second question, the answer would be easy :
    If you want a specific eompls cust to take a particular tunnel/path, just create a seperate pair of loopbacks on the PEs. Make the loopback learnt on the remote PE through the tunnel/path that you want the eompls to take. Then establish the xconnect with this loopback. I am assuming that your question is that a particular eompls session should take a particular path.
    If you meant that certain traffic from the same eompls session take a different path/tunnel, then CBTS will work.
    Regards,
    Niranjan

  • Introduce second default gateway into policy-based routing and optimization

    Questions:
    1) How to get the second PBR_DEFAULT_GATEWAY address 10.20.20.3 into the policy-based routing for redundancy?
    2) Any optimizations as more and more traffic (policy-based routed and otherwise) goes through interface Gi1/0/1?
    Address range A.B.0.0/16 represents assigned Internet-routable addresses.
    Network also uses 10.0.0.0/8, 172.16.0.0/20, 192.168.0.0/16.
    DEFAULT_GATEWAY router participates in OSPF and injects the default routes 0.0.0.0/0 10.10.10.1 and 0.0.0.0/0 10.20.20.1 into OSPF.
    PBR_DEFAULT_GATEWAY router participates in OSPF but filters out default routes injected by DEFAULT_GATEWAY router.
    ROUTER_A participates in OSPF and receives default routes injected by DEFAULT_GATEWAY router.
    ROUTER_A contains the attached policy-routing configuration that allows the subnet A.B.30.0/24 to route anywhere on the network and uses PBR_DEFAULT_GATEWAY as the way out.

    Ok I will see if I can run out to work and try this today..
    After thinking about this, If I need to get to local ip addresses (192.168.1.0 and 192.168.128.0), I might have to change my route map to include those ranges in an ACL, then assign the 172.20.200.1 as the gateway to get to those networks, with the last statement being the traffic to be sent out the firewall
    for instance
    # Access to one of my local networks
    access-list 101 permit ip 172.20.200.0 0.0.0.255 192.168.1.0 0.0.0.255
    # Send Internet traffic to ASA/PIX
    access-list 172 permit ip 172.20.200.0 0.0.0.255 any
    route-map pix-172-20-200 permit 10
    match ip address 101
    set ip next-hop 172.20.200.1
    route-map pix-172-20-200 permit 20
    match ip address 172
    set ip next-hop 172.20.200.2
    and so on?
    I know I need to be in front of my switch to test the change from set ip default next-hop to set ip next-hop...
    I wantto make sure I can still get to the local networks I need to get to.
    I appreciate all your help, and I will test this later on today..
    Thanks
    Don Hickey

  • SRP527-U Policy Based Routing To Squid?

    Hi,
    I have a SRP527-U running 1.2.6.
    I have a simple setup, a ADSL connection to the Internet and a bunch of PC's behind that with Internet access.
    I've setup a host on the same VLAN as the other devices and I've set it up running squid.
    What I'd like to do is use the Policy Based Routing function to force all users trying to browse the Internet through that squid instance.
    That is
    Source of 192.168.0.20/32 Port 80 -> Policy Based Route to Destination of 192.168.0.50 port 3128
    Is that possible with this device, or is that outside of its capabilities?  I've looked at the PBR section, but it seems to imply forcing all traffic out through a WAN Interface which isn't what I want to achieve.
    Kind Regards,
    Tim

    Scott
    If the destination IP is in the same subnet as source IP then it won't be routed it will be L2 switched so it would never use the default gateway ie.
    src IP 172.21.1.10 255.255.255.0
    dst IP 172.21.1.237 255.255.255.0
    src compares it's own IP with it's subnet mask and sees it is on the 172.21.1.x network. src then compares the destination IP with it's own subnet mask and sees it is also on the 172.21.1.x network so it simply arps out for that address and when it gets the mac address it sends it direct to the destination. It would only use the default gateway if the destination IP was on a different network.
    So i don't see how you will be able to do this and i'm not sure why you are seeing hits in your PBR acl for the host in the 172.21.1.x network.
    Edit - what exactly do you mean when you say -
    However when im in vlan 802 my host traffic never gets to 172.21.1.237 when pointed at the gateway 172.21.1.1.
    How are you doing this ie. pointing it to the default gateway because as i say it should always be able to communicate with 172.21.1.237 as it is in the same subnet.
    Jon

  • Policy based routing

    Hello,
    I am setting up PBR. Looking at my configuration, will the next hop apply for both access lists 100 and 101? or will access-list 101 use 192.168.0.1 as the next up? I was hoping acl 101 will use 10.10.10.1 as next up.
    router configuration:
    route-map policy-based-routing permit 10
    match ip address 100
    set ip next-hop 192.168.10.1
    route-map policy-based-routing permit 20
    match ip address 101
    set ip next-hop 10.10.10.1
    access-list 100 permit ip 10.10.10.0 0.0.0.255 192.168.10.0 0.0.0.255
    access-list 100 deny ip 10.10.10.0 0.0.0.255 any
    access-list 101 permit ip 10.10.10.0 0.0.0.255 any
    access-list 101 deny ip any any
    ip route 0.0.0.0 0.0.0.0 10.10.10.1

    Paul,
    All you need is the following configuration.
    route-map policy-based-routing permit 10
    match ip address 100
    set ip next-hop 192.168.10.1
    access-list 100 permit ip 10.10.10.0 0.0.0.255 192.168.10.0 0.0.0.255
    ip route 0.0.0.0 0.0.0.0 10.10.10.1
    with the above configuration applied to the correct incoming interface, all traffic from 10.10.10.0 destined to 192.168.10.0 will use the next hop from the route map and all other traffic wil use the default route
    HTH
    Narayan

  • Photosmart C4780 won't work with my new router.

    Hi
    I have been sent a new plusnet TG582n router after my old one broke and now my wireless printer won't work.
    I have tried uninstalling the software and connecting the printer via USB to reinstall on my windows 7 netbook but it came up with drivers failed to install.
    On my windows 8.1 laptop I have uninstalled and reinstalled and this was unable to complete. I have now done a restore to a previous setting on both of them so the software and drivers are still on.
    I have tried connecting my printer via USB cable but this tries to install the software again.
    If I go into devices my printer shows up with error and won't print.
    After trying all this I have now done a restore on the printer to factore settings (also trying the uninstall and reinstall via USB after this) and it still won't work.
    After doing a wireless test report it came up with my old ssid initially even after installing my new router which has a new ssid. After resetting the printer it now comes up with SigmaplusEOL1. It shows on the report that wirelss is on and working but ssid fail.
    I don't know what else to try as I have spent hours tyring different things and done trouble shooting several times.
    I have also been told by plusnet that t he routershould work for wireless n or wireless g.
    Please help!

    Hi Tazza,
    Welcome to the HP Forums! I understand that your HP Photosmart C4780, will not work with your new router. I am happy to help you with this!  I believe these following guides should help:
    The Printer is Not Found During Wireless Network Installation in Windows.
    Printer Does Not Maintain Wireless Connection.
    Just to make sure the hardware is functional, can you make copies standalone with the printer? Or what happens when you print a status report? Video of Printing a status report.
    Hope to hear from you, and thank you for posting!
    RnRMusicMan
    I work on behalf of HP
    Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
    Click the “Kudos Thumbs Up" to say “Thanks” for helping!

  • Does time machine work with the trash folder?

    Does time machine work with the trash folder? So if I have the entire aperture library backed up to the time machine. Is it safe to empty the trash folder in aperture? I am able to recover files from time machine later?

    So make a top-level Project called "_Circular File".  Put Images in there that you what to have out of your way but not discarded.
    It really is good and proper to treat the Trash as trash.  I instruct everyone to _empty_ the Aperture Trash at the end of _every_ session.  The reason is this: it is the only time you will remember whether it is safe to delete the items in there.  If you wait, you will then waste time trying to answer "Did I really mean to throw that out?" or, periodically, you'll give up trying to remember, and will empty the Trash without reviewing it.  At the end of every session, examine the Trash, confirm that the items there are trash, and empty it.
    Shocking, perhaps, but you should also empty your system trash every day.  The real-life equivalents are good guides here.  No-one in an office hoards their trash.  If you mean to throw something out, throw it out.  If you don't mean to throw it out, do not put it in the trash.
    I don't know how TM handles the Aperture Trash.  I do know, however, that I would not expect this behavior to remain consistent, and would absolutely recommend against a workflow based on it.

Maybe you are looking for