Brocade ICX 6650 Security Configuration Guide 123
53-1002601-01
Policy Based Routing
The permit | deny parameter specifies the action the Brocade device will take if a route matches a
match statement:
•If you specify deny, the Brocade device does not apply a PBR policy to packets that match the
ACLs in a match clause. Those packets are routed normally,
•If you specify permit, the Brocade device applies the match and set statements associated
with this route map instance.
The num parameter specifies the instance of the route map you are defining. Routes are compared
to the instances in ascending numerical order. For example, a route is compared to instance 1,
then instance 2, and so on.
PBR uses up to six route map instances for comparison and ignores the rest.
Syntax: [no] match ip address ACL-num-or-name
The ACL-num parameter specifies a standard or extended ACL number or name.
Syntax: [no] set ip next hop ip-addr
This command sets the next-hop IP address for traffic that matches a match statement in the route
map.
Syntax: [no] set interface null0
This command sends the traffic to the null0 interface, which is the same as dropping the traffic.
Enabling PBR
After you configure the ACLs and route map entries, you can enable PBR globally, on individual
interfaces, or both as described in this section. To enable PBR, you apply a route map you have
configured for PBR globally or locally.
Enabling PBR globally
To enable PBR globally, enter a command such as the following at the global CONFIG level.
Brocade(config)# ip policy route-map test-route
This command applies a route map named “test-route” to all interfaces on the device for PBR.
Syntax: ip policy route-map map-name
Enabling PBR locally
To enable PBR locally, enter commands such as the following.
Brocade(config)# interface ve 1
Brocade(config-vif-1)# ip policy route-map test-route
The commands in this example change the CLI to the Interface level for virtual interface 1, then
apply the “test-route” route map to the interface. You can apply a PBR route map to Ethernet ports
or virtual interfaces.
Syntax: ip policy route-map map-name
Enter the name of the route map you want to use for the route-map map-name parameter.