Brocade Communications Systems 6650 manual Enabling PBR

Policy Based Routing

The permit deny parameter specifies the action the Brocade device will take if a route matches a match statement:

•If you specify deny, the Brocade device does not apply a PBR policy to packets that match the ACLs in a match clause. Those packets are routed normally,

•If you specify permit, the Brocade device applies the match and set statements associated with this route map instance.

The num parameter specifies the instance of the route map you are defining. Routes are compared to the instances in ascending numerical order. For example, a route is compared to instance 1, then instance 2, and so on.

PBR uses up to six route map instances for comparison and ignores the rest.

Syntax: [no] match ip address ACL-num-or-name

The ACL-numparameter specifies a standard or extended ACL number or name.

Syntax: [no] set ip next hop ip-addr

This command sets the next-hop IP address for traffic that matches a match statement in the route map.

Syntax: [no] set interface null0

This command sends the traffic to the null0 interface, which is the same as dropping the traffic.

Enabling PBR

After you configure the ACLs and route map entries, you can enable PBR globally, on individual interfaces, or both as described in this section. To enable PBR, you apply a route map you have configured for PBR globally or locally.

Enabling PBR globally

To enable PBR globally, enter a command such as the following at the global CONFIG level.

Brocade(config)# ip policy route-map test-route

This command applies a route map named “test-route” to all interfaces on the device for PBR.

Syntax: ip policy route-map map-name

Enabling PBR locally

To enable PBR locally, enter commands such as the following.

Brocade(config)# interface ve 1

Brocade(config-vif-1)# ip policy route-map test-route

The commands in this example change the CLI to the Interface level for virtual interface 1, then apply the “test-route” route map to the interface. You can apply a PBR route map to Ethernet ports or virtual interfaces.

Syntax: ip policy route-map map-name

Enter the name of the route map you want to use for the route-map map-nameparameter.

Brocade ICX 6650 Security Configuration Guide	123
53-1002601-01