1

I am trying to configure a policy based route on a brocade VDX (NOS operating system) to direct traffic based on destination subnet.

I want traffic going from 10.5.2.0/23 to 10.5.1.0/25 to be routed by the VE configured on the switch (10.5.2.1)

I want traffic going from 10.5.2.0/23 to anywhere ELSE to go through a pfsense box which is a firewall/router. (10.5.2.2)

To do this I have configured two ACLS specifying source and destination networks

The first says permit traffic from 10.5.2.0/23 to 10.5.1.0/25

show access-list ip emgap01ToStorage in
ip access-list emgap01ToStorage on Ve 3020 at Ingress (From PBR)
seq 10 permit ip 10.5.2.0 255.255.254.0 10.5.1.0 255.255.255.128 (Active)

The next says permit traffic from 10.5.2.0/23 to ANY

show access-list ip emgap01ToFirewall in
ip access-list emgap01ToFirewall on Ve 3020 at Ingress (From PBR)
seq 10 permit ip 10.5.2.0 255.255.254.0 any (Active)

I then apply a route map to these two rules.

First is sequence 10, if traffic matches the first ACL, route normally through the VE assigned

If traffic is not going to the network specified in that acl, it should go to seq 20 which sets the next hop to 10.5.2.2

show route-map emgap
Interface Ve 3020
ip policy route-map emgap permit 10 (Active)
match ip address acl emgap01ToStorage
set ip next-hop 10.5.2.1
Policy routing matches: 0 packets     Note: Counter values are partial

Interface Ve 3020
ip policy route-map emgap permit 20 (Active)
match ip address acl emgap01ToFirewall
set ip next-hop 10.5.2.2 (selected)
Policy routing matches: 0 packets     Note: Counter values are partial

In this configuration, the route does not seem to be applied, traffic is never passed to the firewall (10.5.2.2)

I may have two problems here

  1. I simply wrote the ACLS wrong (Possible because the PBR shows 0 packets matching the policy?)
  2. The router is not sending traffic to the firewall because it is unaware that 10.5.2.2 is a router. Since it's a pfsense box, the brocade is somehow unaware that 10.5.2.2 can route things.

Here is the running config for the route map

route-map emgap permit 10
match ip address acl emgap01ToStorage
set ip next-hop 10.5.2.1
!
route-map emgap permit 20
match ip address acl emgap01ToFirewall
set ip next-hop 10.5.2.2

And a basic picture of my desired topology

topology

Improve this question
2
  • I have never configured a Brocade device, but when you say you want to route based on the destination address, that's what "normal" routing does. I suspect you don't need to use PBR. In the Cisco world, you would just create two static routes: ip route 10.5.1.0 255.255.255.128 10.5.2.1 and ip route 0.0.0.0 0.0.0.0 10.5.2.2. Since NOS looks very similar to IOS, perhaps this would work as well.
    – Ron Trunk
    Apr 1, 2015 at 1:46
  • I can't use a static route because there are other networks in my topology that route to 10.5.3.0 and 10.5.1.0 networks(not pictured). I specifically need a policy to route traffic based on source AND destination address. If i could assign a static route like you've mentioned above to a specific VE(virtual routing interface) or vlan that would also work i suppose
    – Party Time
    Apr 1, 2015 at 7:57

1 Answer 1

Reset to default
1

Turns out that in NOS 4.1.2 PBR is broken if your next hop traverses port-channel or VLAG.

In this case the 10.5.2.2 router is accessed over an LACP trunk from 10.5.2.1 router, which breaks the PBR

This is fixed in firmware 4.1.3

brocade-bug

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.