Policy-based routing (PBR) and reliable PBR with IP SLA tracking

Routing by policy instead of destination

A router normally chooses the next hop from the destination address alone, using the routing table (see how routers forward packets). Sometimes you want a different rule. A school might want guest Wi-Fi to use a cheap broadband line and staff traffic to use the leased line; a company might want backup traffic to avoid the link used for voice. Policy-based routing (PBR) does this by matching packets on source, destination, protocol or ports and setting the next hop or exit interface for them.

Configuring PBR

PBR uses an ACL to select traffic, a route-map to set the action, and the ip policy command on the interface where the traffic enters the router.

ip access-list extended GUEST-NET
 permit ip 192.168.50.0 0.0.0.255 any
route-map PBR-GUEST permit 10
 match ip address GUEST-NET
 set ip next-hop 198.51.100.1
interface GigabitEthernet0/0.50
 description Guest VLAN
 ip policy route-map PBR-GUEST
show route-map PBR-GUEST
show ip policy

Packets that match are sent to 198.51.100.1, the broadband router. Packets that do not match, or match a deny statement, are routed normally. PBR is processed in hardware on most current switches and routers, but check your platform. It only applies to transit traffic; traffic created by the router itself needs ip local policy route-map.

Useful set options include set ip next-hop (a list of next hops, used in order), set ip default next-hop (used only if the routing table has no explicit route other than the default), and set interface for point-to-point links.

Reliable PBR with IP SLA

A plain set ip next-hop keeps sending traffic to that address as long as it is in the ARP or routing table, even if the internet behind it has failed. IP SLA sends regular probes, such as pings, and object tracking turns the result into an up or down state that PBR can check.

ip sla 1
 icmp-echo 198.51.100.1 source-interface GigabitEthernet0/2
 frequency 5
ip sla schedule 1 life forever start-time now
track 1 ip sla 1 reachability
route-map PBR-GUEST permit 10
 match ip address GUEST-NET
 set ip next-hop verify-availability 198.51.100.1 1 track 1
show track 1

If the probe fails, track 1 goes down, the next hop is skipped and guest traffic follows the normal routing table, for example the leased line. Probe something beyond the first hop, such as a public DNS server, if you want to detect failures inside the provider's network too. The same tracking objects make static routes reliable, as shown in static and floating static routes.

When to use PBR, and when not

• Good uses: steering particular subnets or applications over a second link, sending traffic through a filtering appliance, or temporary workarounds during migrations.
• Drawbacks: PBR is invisible in the routing table, so it confuses troubleshooting; it must be configured on every ingress interface; and complex policies are hard to maintain.
• Alternatives: SD-WAN application-aware routing does the same job centrally with live path measurements (see SD-WAN path selection).

Real-world example: a further education college had a fast leased line for staff and a separate 500 Mb/s broadband line it was paying for but barely using. The engineer applied PBR on the student Wi-Fi sub-interface to send student traffic out through the broadband router, with an IP SLA probe to a public resolver. When the broadband line failed during exam week, the track went down, student traffic moved to the leased line within seconds, and the helpdesk only noticed when the restoration alert arrived.