Cisco Route-Maps are powerful tools that network administrators use to implement flexible routing policies. They employ "if-then" logic, allowing you to match specific criteria in network traffic or routes and then perform actions based on those matches. Understanding Cisco Route-Maps: Configuration and Logic is essential for advanced network management and optimization.

What are Cisco Route-Maps and Their Purpose?

A route-map on Cisco devices acts as a sophisticated policy-based routing mechanism. It allows for detailed control over how routing information is processed and advertised. You can use route-maps to filter routes, modify route attributes, and steer traffic based on various conditions.

Common Applications of Cisco Route-Maps

Route-maps are incredibly versatile and can be used for numerous networking tasks. Here are some quick examples:

Filtering Routes: Advertise only specific EIGRP routes to a neighbor. For instance, if a prefix matches 192.168.1.0/24 in an access-list, advertise it.
Setting BGP Attributes: Modify BGP attributes based on certain match conditions. An example would be if a prefix matches 192.168.0.0/24, set the BGP local preference to 500.
Route Redistribution: Control the redistribution of networks between different routing protocols. For example, if a prefix matches 192.168.4.0/24, redistribute it from OSPF into EIGRP.
Policy-Based Routing (PBR): Change the next-hop IP address for packets based on criteria like packet length. If a packet length is greater than 500 bytes, change the next hop to 192.168.1.254.

How Cisco Route-Maps Work: The Core Logic

Similar to access-lists, route-maps process statements sequentially from top to bottom. Each statement has an associated sequence number, and the router stops processing at the first match.

Sequential Processing and Outcome

When a route or packet is evaluated against a route-map, the router goes through each statement in order:

Match: If a match is found, the specified action (permit or deny, along with any set commands) is applied, and no further route-map statements are checked.
No Match: If no match occurs for a statement, the router proceeds to the next route-map statement.

Permit vs. Deny Statements in Route-Maps

Each route-map statement can be configured as either permit or deny. This determines the outcome if a match condition is met:

permit: If a route matches a permit statement, it is allowed to pass through the route-map, and any set actions are applied.
deny: If a route matches a deny statement, it is blocked or prevented from being processed further by the route-map.

Match Conditions: Identifying Network Elements

Route-maps use match conditions to identify the specific attributes of routes or packets that you want to affect. There's a wide range of criteria you can match on, making route-maps incredibly flexible.

Common match conditions include:

IP Address/Prefix: Using access-lists or prefix-lists.
BGP Attributes: Such as AS-path, community, local preference, or origin.
Interface: The ingress interface of a route or packet.
Metric/Tag: The metric or tag of a route.
Packet Length: For policy-based routing.
Source Protocol: The routing protocol from which the route originated.

It's important to note that if a route-map statement has no match condition, it implicitly matches everything.

Set Actions: Modifying Route Attributes

Beyond just matching and permitting/denying, the true power of route-maps comes from the set command. This allows you to modify various attributes of a route or packet if the match condition is met. This constitutes the "then" part of the "if-then" logic.

Examples of set commands include:

Changing Metrics: Adjusting the metric for EIGRP, OSPF, or other routing protocols.
BGP Attributes: Setting BGP AS-path, community, local preference, or weight.
Next-Hop IP Address: For policy-based routing.
DSCP Value: Setting the Differentiated Services Code Point value of an IP packet.
Tags: Assigning a tag to a route for further processing.

The Invisible Implicit Deny

Just like access-lists, route-maps conclude with an invisible, implicit deny statement. This means that if a route or packet does not match any permit or deny statement within the route-map, it will ultimately be denied by this final implicit deny. This is a crucial concept to remember when configuring route-maps to avoid unintended blocking of traffic or routes.

Multiple Match Conditions and Set Actions

Multiple Match Conditions: If you configure multiple match conditions within a single route-map statement, they function as a logical OR. If any of the specified match conditions are met, the statement is considered a match.
Multiple Set Commands: You can also configure multiple set commands within a single route-map statement. All specified set actions will be applied if the match condition is met.

Prerequisites for Cisco Route-Map Configuration

Before diving into route-map configuration, a basic understanding of Access Control Lists (ACLs) is highly recommended. Familiarity with prefix-lists can also be helpful, though not strictly required.

Cisco Route-Map Configuration Examples and Logic Breakdown

Let's explore some practical examples of route-map configuration, demonstrating how the permit/deny and match/set logic works.

For these examples, we'll assume a two-router setup (R1 and R2) with EIGRP pre-configured, where R1 advertises loopback interfaces to R2. Initially, R2 sees 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24 from R1.

Basic Match Condition - Permit

Here, we use a route-map with a permit statement and an access-list to filter networks.

Goal: Permit only 192.168.0.0/24.

ip access-list standard R1_L0_PERMIT
 permit 192.168.0.0 0.0.0.255
!
route-map TEST_1 permit 10
 match ip address R1_L0_PERMIT
!
router eigrp 1
 distribute-list route-map TEST_1 in

Logic: The access-list R1_L0_PERMIT permits 192.168.0.0/24 and implicitly denies everything else. The route-map TEST_1 has one permit statement. If a route matches R1_L0_PERMIT (i.e., 192.168.0.0/24), the route-map permits it. All other routes are implicitly denied by the access-list, and thus don't match the route-map, hitting the route-map's implicit deny.

Result on R2: Only 192.168.0.0/24 is visible in the routing table.

Access-list Deny in Route-Map Permit

This example shows how an access-list's deny statement interacts with a route-map's permit statement.

Goal: Filter 192.168.0.0/24 using an ACL deny statement.

ip access-list standard R1_L0_DENY
 deny 192.168.0.0 0.0.0.255
!
route-map TEST_2 permit 10
 match ip address R1_L0_DENY
!
router eigrp 1
 distribute-list route-map TEST_2 in

Logic: The access-list R1_L0_DENY denies 192.168.0.0/24 and implicitly denies everything else. Because nothing is explicitly permitted in the ACL, nothing matches the route-map's match condition. All routes are dropped by the route-map's implicit deny.

Result on R2: No routes are visible in the routing table. To deny only 192.168.0.0/24 and permit everything else, R1_L0_DENY would need an additional permit any statement.

Match Condition - Deny

Now, let's reverse the route-map's logic using a deny statement.

Goal: Deny 192.168.0.0/24 but permit everything else.

ip access-list standard R1_L0_PERMIT
 permit 192.168.0.0 0.0.0.255
!
route-map TEST_3 deny 10
 match ip address R1_L0_PERMIT
route-map TEST_3 permit 20
!
router eigrp 1
 distribute-list route-map TEST_3 in

Logic: The access-list R1_L0_PERMIT matches 192.168.0.0/24. The route-map TEST_3 has two statements. Statement 10 denys any route that matches R1_L0_PERMIT. Statement 20 is a permit statement with no match condition, meaning it permits everything else.

Result on R2: 192.168.0.0/24 is denied, but 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24 are visible.

Access-list Deny in Route-Map Deny

This can be a confusing combination, often referred to as a "double negative."

Goal: Use an ACL with a deny statement in a route-map with a deny statement.

ip access-list standard R1_L0_DENY
 deny 192.168.0.0 0.0.0.255
!
route-map TEST_4 deny 10
 match ip address R1_L0_DENY
route-map TEST_4 permit 20
!
router eigrp 1
 distribute-list route-map TEST_4 in

Logic: The access-list R1_L0_DENY denies 192.168.0.0/24 and implicitly denies everything else. Because the ACL denies all traffic, nothing ever "matches" the match ip address R1_L0_DENY condition to trigger the deny 10 statement in the route-map. Instead, everything passes through statement 10 and hits statement 20, which permits everything.

Result on R2: All routes (192.168.0.0/24 through 192.168.3.0/24) are visible. This demonstrates that a deny in an access-list combined with a deny in a route-map does not result in a permit.

Understanding Permit/Deny Interactions in Route-Maps

Here's a quick summary of how route-map and match condition outcomes interact:

Route-map permit + Match: The route is permitted, and no further route-map statements are processed.
Route-map permit + No Match: The route is not permitted by this statement; processing continues to the next route-map statement.
Route-map deny + Match: The route is denied, and no further route-map statements are processed.
Route-map deny + No Match: The route is not denied by this statement; processing continues to the next route-map statement.

Multiple Match Conditions (Logical OR)

You can specify multiple access-lists or prefix-lists in a single match ip address command. This creates a logical OR condition.

Goal: Permit 192.168.1.0/24 OR 192.168.2.0/24.

ip access-list standard R1_L1_PERMIT
 permit 192.168.1.0 0.0.0.255
!
ip access-list standard R1_L2_PERMIT
 permit 192.168.2.0 0.0.0.255
!
route-map MULTIPLE_MATCH permit 10
 match ip address R1_L1_PERMIT R1_L2_PERMIT
!
router eigrp 1
 distribute-list route-map MULTIPLE_MATCH in

Logic: If a route matches either R1_L1_PERMIT or R1_L2_PERMIT, the route-map permits it. Other routes are implicitly denied.

Result on R2: Both 192.168.1.0/24 and 192.168.2.0/24 are visible.

Set Action Configuration: Modifying Metrics

This example demonstrates changing the EIGRP metric using a set command. We'll redistribute a new loopback interface into EIGRP.

Goal: Redistribute 172.16.1.0/24 into EIGRP and set its metric.

interface Loopback4
 ip address 172.16.1.1 255.255.255.0
!
ip access-list standard R1_L4
 permit 172.16.1.0 0.0.0.255
!
route-map SET permit 10
 match ip address R1_L4
 set metric 1500 10 255 255 1500
!
router eigrp 1
 redistribute connected route-map SET

Logic: The route-map SET matches 172.16.1.0/24. When this route is redistributed, the set metric command applies a custom EIGRP composite metric (bandwidth, delay, reliability, load, MTU). You can verify this on R2.

Result on R2: 172.16.1.0/24 appears as an EIGRP external route (D EX) with the specified metric.

Key Takeaways for Cisco Route-Map Mastery

Route-maps process statements sequentially, stopping at the first match.
Each statement can be permit or deny, with optional match and set commands.
An empty route-map statement (no match condition) matches everything.
Route-maps end with an invisible implicit deny, similar to access-lists.
match conditions are diverse, including prefix-lists, access-lists, BGP attributes, and packet length.
set commands change values like metrics, next-hop addresses, BGP attributes, and DSCP values.
Multiple match conditions in one statement work as a logical OR.
Multiple set commands can be configured in a single statement.

Frequently Asked Questions about Cisco Route-Maps

What is a route-map in Cisco and why is it used?

A route-map in Cisco IOS is a configuration tool that uses if-then logic to apply policies to routes or packets. It's used to filter, modify, or redirect traffic and routing updates based on specific criteria, offering granular control over network behavior.

How do route-maps process statements and what happens after a match?

Route-maps process statements in sequential order, determined by their sequence numbers. Once a route or packet matches the conditions of a statement, the actions (permit/deny and set commands) specified in that statement are applied, and the processing for that route/packet stops. The router does not evaluate any subsequent statements.

What is the implicit deny in route-maps and why is it important?

The implicit deny is an invisible, final statement at the end of every route-map. If a route or packet does not match any of the explicitly configured permit or deny statements, it will be denied by this implicit deny. It's crucial because it ensures that only explicitly permitted items pass through, preventing unintended traffic flow if not all conditions are covered.

Can a route-map have multiple match conditions in a single statement?

Yes, a route-map statement can have multiple match conditions. When multiple match conditions are configured within the same statement (e.g., match ip address ACL1 ACL2), they operate as a logical OR. If a route or packet matches any one of the specified conditions, the entire statement is considered a match.

What can you do with the "set" command in route-maps?

The set command in route-maps allows you to modify various attributes of a route or packet once a match condition is met. This includes changing routing protocol metrics (like EIGRP's composite metric), setting BGP attributes (such as local preference, AS-path, or community), modifying next-hop IP addresses for policy-based routing, or assigning a tag to a route. It's the action component of the route-map's "if-then" logic.

Cisco Route-Maps: Configuration and Logic