Brocade Communications Systems 6650 manual Setting the output interface to the null interface

Policy Based Routing

Brocade(config)# route-map test-route permit 50 Brocade(config-routemap test-route)# match ip address 50 Brocade(config-routemap test-route)# set ip next-hop 192.168.2.1 Brocade(config-routemap test-route)# exit

The following commands configure the second entry in the route map. This entry (permit 51) matches on the IP address information in ACL 51 above. For IP traffic from subnet 10.157.24.0/24, this route map entry sets the next-hop IP address to 192.168.2.2.

Brocade(config)# route-map test-route permit 51 Brocade(config-routemap test-route)# match ip address 51 Brocade(config-routemap test-route)# set ip next-hop 192.168.2.2 Brocade(config-routemap test-route)# exit

The following commands configure the third entry in the test-route route map. This entry (permit

52)matches on the IP address information in ACL 52 above. For IP traffic from subnet 10.157.25.0/24, this route map entry sets the next-hop IP address to 192.168.2.3.

Brocade(config)# route-map test-route permit 52 Brocade(config-routemap test-route)# match ip address 52 Brocade(config-routemap test-route)# set ip next-hop 192.168.2.3 Brocade(config-routemap test-route)# exit

The following command enables PBR by globally applying the test-route route map to all interfaces.

Brocade(config)# ip policy route-map test-route

Alternatively, you can enable PBR on specific interfaces, as shown in the following example. The commands in this example configure IP addresses in the three source subnets identified in ACLs 50, 51, and 52, then apply route map test-route to the interface.

Brocade(config)# interface ve 1

Brocade(config-vif-1)# ip address 10.157.23.1/24

Brocade(config-vif-1)# ip address 10.157.24.1/24

Brocade(config-vif-1)# ip address 10.157.25.1/24

Brocade(config-vif-1)# ip policy route-map test-route

Setting the output interface to the null interface

The following commands configure a PBR policy to send all traffic from 192.168.1.204/32 to the null interface, thus dropping the traffic instead of forwarding it.

Brocade(config)# access-list 56 permit 10.168.1.204 0.0.0.0

The following commands configure an entry in a route map called “file-13”. The first entry (permit

56)matches on the IP address information in ACL 56 above. For IP traffic from the host 10.168.1.204/32, this route map entry sends the traffic to the null interface instead of forwarding it, thus sparing the rest of the network the unwanted traffic.

Brocade(config)# route-map file-13 permit 56

Brocade(config-routemap file-13)# match ip address 56

Brocade(config-routemap file-13)# set interface null0

Brocade(config-routemap file-13)# exit

The following command enables PBR by globally applying the route map to all interfaces.

Brocade(config)# ip policy route-map file-13

Alternatively, you can enable PBR on specific interfaces, as shown in the following example. The commands in this example configure IP addresses in the source subnet identified in ACL 56, then apply route map file-13 to the interface.

Brocade ICX 6650 Security Configuration Guide	125
53-1002601-01