Cisco Route-Maps for Network Policy

Cisco Route-Maps are powerful tools used in network policy enforcement on Cisco devices. They employ an "if-then" logic, allowing network administrators to match specific criteria and then perform actions based on those matches. This guide will explore how route-maps function, their various applications, and provide practical configuration examples to help you master this essential networking concept.

Understanding Cisco Route-Maps: The Core Concepts

A Cisco Route-Map acts as a flexible mechanism for implementing network policies. It operates by processing a series of statements, each with an optional match condition and an optional set command. If a match condition is met, the associated set command is executed, and processing for that route or packet typically stops. If no match is found for a statement, processing continues to the next statement in sequence.

How Route-Maps Work: If-Then Logic

Route-maps follow a sequential, top-to-bottom processing order. Each statement is identified by a sequence number, and the device processes them in ascending order.

• Match: If an incoming route or packet satisfies the criteria defined in the match command of a statement, it's considered a match. Once a match occurs, the set commands (if any) are applied, and the route-map processing for that specific item concludes.
• No Match: If no match is found for a statement's criteria, the device proceeds to evaluate the next statement in the sequence.

Permit and Deny Statements in Route-Maps

Similar to Access Control Lists, route-maps use permit and deny keywords for each statement. This keyword dictates the overall action of the route-map when a match occurs:

• permit statement: If a match occurs in a permit statement, the route or packet is allowed to proceed, and any set actions are applied.
• deny statement: If a match occurs in a deny statement, the route or packet is typically discarded or prevented from being processed further by that route-map.

The Invisible Implicit Deny

Crucially, just like access-lists, route-maps end with an invisible implicit deny statement. This means if a route or packet traverses all statements in a route-map and doesn't find a match, it will be denied by default.

Match Conditions: Specifying What to Look For

Route-maps offer a wide range of criteria you can use in match commands to identify specific routes or packets. These conditions are fundamental to defining your network policy.

Common match conditions include:

• ip address: Matches IP addresses using access-lists or prefix-lists.
• prefix-list: Matches specific network prefixes.
• BGP Attributes: Such as local preference, AS path, or community lists.
• interface: Matches routes advertised through or to a specific interface.
• metric: Matches routes based on their metric value.
• length: Matches packets based on their length (useful for Policy-Based Routing).
• tag: Matches routes based on a configured tag value.
• source-protocol: Matches routes learned from a specific routing protocol.

If a route-map statement has no match condition, it effectively matches everything.

Multiple Match Conditions: Logical OR

When you configure multiple match conditions within a single route-map statement, they function as a logical OR. This means if a route or packet matches any of the specified conditions in that statement, the entire statement is considered a match.

Set Actions: Modifying Network Attributes

The true power of route-maps lies in their set commands. Once a route or packet matches a condition, you can use set to modify various attributes or dictate specific behavior. This is the "then" part of the "if-then" logic.

Examples of set commands include:

• metric: Changes the metric of a route (e.g., for redistribution into EIGRP or OSPF).
• next-hop: Modifies the next-hop IP address (often used in Policy-Based Routing).
• BGP Attributes: Such as local-preference, community, weight, or as-path prepending.
• tag: Assigns a tag value to a route.
• dscp: Sets the Differentiated Services Code Point (DSCP) value of an IP packet.
• interface: Specifies an output interface.

Multiple Set Commands

You can configure multiple set commands within a single route-map statement. All configured set actions for that statement will be applied if the match condition is met.

Configuring Cisco Route-Maps: Practical Examples

Let's explore several practical examples to solidify your understanding of route-maps. We'll use EIGRP route filtering and redistribution scenarios on Cisco routers.

Prerequisites: A basic understanding of access-lists is highly recommended before diving into route-maps.

Consider a scenario where R1 advertises several loopback interfaces to R2 via EIGRP. R2 initially sees these networks:

R2# show ip route eigrp | include /24
D 192.168.0.0/24
D 192.168.1.0/24
D 192.168.2.0/24
D 192.168.3.0/24

Example 1: Filtering EIGRP Routes with permit and Access-List

We want to permit only 192.168.0.0/24 using a route-map applied to an EIGRP distribute-list.

1. Create a standard access-list:

R2(config)# ip access-list standard R1_L0_PERMIT
R2(config-std-nacl)# permit 192.168.0.0 0.0.0.255

2. Create a route-map statement with permit:

R2(config)# route-map TEST_1 permit 10
R2(config-route-map)# match ip address R1_L0_PERMIT

3. Apply the route-map to EIGRP as an in distribute-list:

R2(config)# router eigrp 1
R2(config-router)# distribute-list route-map TEST_1 in

Result: Only 192.168.0.0/24 will appear in R2's EIGRP routing table. This is because:

• The access-list permits 192.168.0.0/24 and implicitly denies everything else.
• The route-map permit 10 statement matches 192.168.0.0/24 via the access-list.
• All other routes are implicitly denied by the access-list, and thus don't match TEST_1 permit 10. Since there are no other route-map statements, they are then dropped by the route-map's implicit deny.

Example 2: Understanding Implicit Deny with permit and Access-List deny

Let's try a route-map permit statement with an access-list that has a deny statement.

1. Create a standard access-list to deny a network:

R2(config)# ip access-list standard R1_L0_DENY
R2(config-std-nacl)# deny 192.168.0.0 0.0.0.255

2. Create a route-map with permit and match the deny access-list:

R2(config)# route-map TEST_2 permit 10
R2(config-route-map)# match ip address R1_L0_DENY

3. Apply the route-map:

R2(config)# router eigrp 1
R2(config-router)# distribute-list route-map TEST_2 in

Result: No EIGRP routes will be in R2's routing table. This happens because:

• The access-list R1_L0_DENY denies 192.168.0.0/24 and implicitly denies everything else. Thus, no routes actually match the R1_L0_DENY access-list in a positive sense for the match ip address command.
• Since no routes match the access-list, nothing matches the route-map TEST_2 permit 10 statement.
• Everything then falls through to the implicit deny of the route-map.

To permit all other routes, the R1_L0_DENY access-list would need a permit any statement at the end.

Example 3: Route-Map deny with Access-List permit (and permitting others)

Here, we use a route-map deny statement to block 192.168.0.0/24 and then permit everything else.

1. Use the R1_L0_PERMIT access-list from Example 1:

R2# show access-lists R1_L0_PERMIT
Standard IP access list R1_L0_PERMIT
10 permit 192.168.0.0, wildcard bits 0.0.0.255

2. Create a route-map deny statement matching the access-list:

R2(config)# route-map TEST_3 deny 10
R2(config-route-map)# match ip address R1_L0_PERMIT

3. Initially, applying this will result in no routes, due to the route-map's implicit deny. To permit other routes, add another statement:

R2(config)# route-map TEST_3 permit 20

(No match condition here means it matches everything.)

4. Apply to EIGRP:

R2(config)# router eigrp 1
R2(config-router)# distribute-list route-map TEST_3 in

Result: R2's routing table will show all networks except 192.168.0.0/24.

• route-map TEST_3 deny 10 matches 192.168.0.0/24 and denies it.
• Other networks don't match TEST_3 deny 10 (since R1_L0_PERMIT only permits 192.168.0.0/24).
• These other networks then proceed to route-map TEST_3 permit 20, which matches everything and permits them.

Example 4: Route-Map deny with Access-List deny (The "Double Negative")

This combination often causes confusion. Let's use R1_L0_DENY (which denies 192.168.0.0/24 and implicitly denies all others) with a route-map deny statement.

1. Use the R1_L0_DENY access-list:

R2# show access-lists R1_L0_DENY
Standard IP access list R1_L0_DENY
10 deny 192.168.0.0, wildcard bits 0.0.0.255

2. Create a route-map deny statement matching this access-list:

R2(config)# route-map TEST_4 deny 10
R2(config-route-map)# match ip address R1_L0_DENY

3. Apply to EIGRP:

R2(config)# router eigrp 1
R2(config-router)# distribute-list route-map TEST_4 in

Result: Initially, there are no routes. Just like Example 2, the access-list R1_L0_DENY denies everything, so nothing actually matches it. Therefore, no routes match TEST_4 deny 10, and everything hits the route-map's implicit deny.

To see any routes, you'd add a permit 20 statement to the route-map:

R2(config)# route-map TEST_4 permit 20

Now, R2 will see all routes, including 192.168.0.0/24. The "double negative" does not mean a match. The deny in the access-list means the condition is not met, so the route-map statement does not process that route further.

Example 5: Multiple Match Conditions (Logical OR)

We'll match two different networks using separate access-lists within a single route-map statement.

1. Create two access-lists:

R2(config)# ip access-list standard R1_L1_PERMIT
R2(config-std-nacl)# permit 192.168.1.0 0.0.0.255
R2(config)# ip access-list standard R1_L2_PERMIT
R2(config-std-nacl)# permit 192.168.2.0 0.0.0.255

2. Create a route-map statement matching both access-lists (logical OR):

R2(config)# route-map MULTIPLE_MATCH permit 10
R2(config-route-map)# match ip address R1_L1_PERMIT R1_L2_PERMIT

3. Apply to EIGRP:

R2(config)# router eigrp 1
R2(config-router)# distribute-list route-map MULTIPLE_MATCH in

Result: R2's routing table will show both 192.168.1.0/24 and 192.168.2.0/24.

Example 6: Using Set Actions for Redistribution and Metric Modification

This example demonstrates changing a route's metric during redistribution.

1. Configure a new loopback interface on R1 and an access-list:

R1(config)# interface Loopback4
R1(config-if)# ip address 172.16.1.1 255.255.255.0
R1(config)# ip access-list standard R1_L4
R1(config-std-nacl)# permit 172.16.1.0 0.0.0.255

2. Create a route-map with a set metric command:

R1(config)# route-map SET permit 10
R1(config-route-map)# match ip address R1_L4
R1(config-route-map)# set metric 1500 10 255 255 1500

(The set metric command for EIGRP requires bandwidth, delay, reliability, load, and MTU values.)

3. Redistribute connected routes into EIGRP, referencing the route-map:

R1(config)# router eigrp 1
R1(config-router)# redistribute connected route-map SET

Result: R2 will learn the 172.16.1.0/24 network from R1, and its EIGRP metric will reflect the values set in the route-map.

R2# show ip route eigrp 172.16.0.0/24
172.16.0.0/24 is subnetted, 1 subnets
D EX 172.16.1.0 [170/1709312] via 192.168.12.1, 00:01:41, GigabitEthernet0/1

If you modify the set metric values in the route-map, R2's routing table will update to show the new metric.

Key Takeaways for Cisco Route-Maps

• Sequential Processing: Route-maps process statements from top to bottom, stopping at the first match.
• Permit/Deny Logic: Each statement can permit or deny, determining the ultimate outcome for a matched route/packet.
• Implicit Deny: Every route-map ends with an invisible implicit deny, dropping anything that doesn't explicitly match and get permitted.
• Match Conditions: Use match commands to specify criteria like access-lists, prefix-lists, BGP attributes, or packet length.
• Set Actions: Use set commands to modify attributes such as metrics, next-hop addresses, BGP attributes, or DSCP values.
• No Match Condition: A statement without a match condition matches everything.
• Multiple Matches (OR): Multiple match conditions in one statement work as a logical OR.
• Multiple Sets: You can configure multiple set commands in a single statement.

Frequently Asked Questions about Cisco Route-Maps

What is a Cisco Route-Map used for in network policy?

Cisco Route-Maps are versatile tools used to implement detailed network policies. They allow you to control routing updates, filter networks, modify route attributes (like metrics or next-hop IP addresses), and influence traffic flow through conditional logic, often applied in redistribution, BGP, or policy-based routing scenarios.

How does the match ip address command work in a route-map?

The match ip address command in a route-map allows you to specify an IP access-list or prefix-list. If a route's network or a packet's source/destination IP address is permitted by the referenced access-list/prefix-list, then the match condition in the route-map statement is considered successful.

What is the difference between a permit and deny statement in a route-map?

When a match occurs in a route-map, a permit statement means the route/packet is accepted and any set actions are applied, continuing its processing. A deny statement, however, means the route/packet is dropped or blocked from further processing by that route-map, effectively preventing it from being advertised, redistributed, or forwarded via that policy.

Can a route-map have multiple match conditions, and how do they interact?

Yes, a single route-map statement can have multiple match conditions. When multiple match conditions are present within the same statement (e.g., match ip address access-list1 access-list2), they operate as a logical OR. This means if a route or packet matches any one of the specified conditions, the entire statement is considered a match, and the associated set commands (if any) are executed. If you need a logical AND, you would typically use separate match conditions in different route-map statements and ensure they are processed sequentially, or combine them logically within a single complex access-list or prefix-list.