Policy Based Routing by Interface and IP

Question

Is it possible on Juniper or Cisco to configure PBR where it matches on an ingress interface AND a source IP address?

My scenario traffic flows are as follows:

Router1 > Router2 > WAN_Optimiser > Router2 > Firewall > Router2 > Router3

Both the WAN Optimiser and Firewall are in transparent mode and sit connected off Router2 on a single interface each.

I need to be able to have traffic come into router2, be directed to the WAN Optimiser, return to Router2, then be directed to the firewall, then be returned to Router2, before being router to its intended destination.

The rules would look something like for outgoing traffic

Source: 10.0.0.1/24
Dest: 20.0.0.1/24

Rule 1

match interface <interface connected to router1>
match ip range 10.0.0.0/24
then send to <interface connected to wan_opt>

Rule 2

match interface <interface connected to wan_opt>
match ip range 10.0.0.0/24
then send to <interface connected to firewall>

Answer 1

Putting aside the wisdom of your traffic flow scenario, you can accomplish this on a Cisco device as well.

Policy-based routing is applied to an incoming interface, so you will have three different policies -- each applied to a different interface. For example:

ip access-list standard PBR-DEMO
permit 10.0.0.0 0.0.0.255

route-map FROM-R1 permit 10
match ip address  PBR-DEMO
set ip next-hop <Wan optimizer>

route-map FROM-OPT permit 10
match ip address PBR-DEMO
set ip next-hop <Firewall>

route-map FROM-FW permit 10
match ip address  PBR-DEMO
set ip next-hop <router-3>

interface <router 1>
ip policy route-map FROM-R1

interface <Wan optimizer>
ip policy route-map FROM-OPT

interface <firewall>
ip policy route-map FROM-FW

Answer 2

Neither way policy based routing can applyed for both inbound and outbound traffic in cisco and juniper firewalls

For outbound traffic

When user want to access resources in internet and wants to use specific ISPs connectivity when two or more ISP or connected for firewall. This policy based routing will ensure traffic is diverted to selected ISP when multiple ISP links are present . Generally PBR is configured with specific source ip address and destination address exist interface and gateway of exist interface . Same as for inbound traffic basically policy based routing has priority then normal routing . Firewalls will first check policy based routing table to forward traffic then after it will check normal routing table...

Answer 3

PBR in Juniper land is called Filter Based Forwarding. FBF uses ingress firewall filters to match and move traffic into a forwarding routing instance. What you could do here assuming you're on a MX or SRX platform, is apply an ingress filter to your source interface like so:

• Firstly you need to create a routing instance to forward the traffic into (This instance should hold a default route towards your WAN Optimiser)

set routing-instance WAN-OP instance-type forwarding 

(You will also need to create a rib-group or instance-import statement to import/export interfaces to the instance RIB/default RIB)

• Create a firewall filter to match your traffic (Because we're applying this filter to a single ingress interface we are only matching traffic from this interface)

set firewall family inet filter FORWARD-TO-WAN-OP term 1 from source-address 10.0.0.0/24
set firewall family inet filter FORWARD-TO-WAN-OP term 1 then routing-instance WAN-OP

• Apply your filter to the ingress interface

set interfaces xxxx unit xxx family inet filter input FORWARD-TO-WAN-OP

Now, when traffic enters that logicial interface with a source of 10.0.0.0/24, traffic will be moved from inet.0 into the WAN-OP.inet.0 RIB to follow the instances routing table.

Your WAN Optimiser can then return traffic back to the same Junos device to follow the default route in inet.0. Just ensure the traffic returns back from the WAN Optimiser on a logicial interface that doesn't contain our newly created filter.