Cisco Route-Maps are incredibly versatile tools on Cisco devices, enabling network administrators to implement sophisticated network policies and fine-tune routing behavior. Understanding Cisco Route-Maps: Network Policy & Routing is crucial for anyone managing complex network environments, as they provide an "if-then" logic for manipulating network traffic and advertisements.

Understanding Cisco Route-Maps: Core Concepts

A route-map acts as a programmable filter and modifier for routing information. It processes statements sequentially, applying specific actions based on defined match conditions. This powerful mechanism allows for granular control over how routes are learned, advertised, and redistributed across your network.

How Cisco Route-Maps Work: The If-Then Logic

At its heart, a route-map functions with an "if-then" logic. If a route or packet matches a specific condition, then a defined action is taken. This makes route-maps much more flexible than simple access-lists.

Key takeaways regarding route-map operations include:

Route-maps process statements from top to bottom, stopping at the first match.
Each statement can be permit or deny, optionally including match and set commands.
An empty route-map statement (without a match condition) will match everything.
Route-maps conclude with an invisible implicit deny, similar to access-lists.
Multiple match conditions within one statement function as a logical OR.
You can configure multiple set commands in a single statement.

Prerequisites for Learning Cisco Route-Maps

Before diving deep into route-maps, a basic understanding of how access-lists work is highly recommended. While not strictly required, familiarity with prefix-lists can also be beneficial.

Exploring Cisco Route-Map Configuration Examples

Let's walk through practical examples to illustrate how to configure and apply route-maps. We'll use a scenario with two routers, R1 and R2, where EIGRP is pre-configured and R1 advertises loopback interfaces to R2.

Initially, R2 has learned four networks from R1:

D 192.168.0.0/24 D 192.168.1.0/24 D 192.168.2.0/24 D 192.168.3.0/24

Our goal is to use route-maps to filter these networks.

Route-Map with a Permit Statement and Access-List Match

First, we create a route-map named TEST_1 with a permit statement and sequence number 10:

R2(config)# route-map TEST_1 permit 10

Next, we define a match condition using an access-list. We'll match ip address and refer to a standard access-list named R1_L0_PERMIT:

R2(config-route-map)# match ip address R1_L0_PERMIT

Now, let's create the access-list itself, permitting only the 192.168.0.0/24 network:

R2(config)# ip access-list standard R1_L0_PERMIT R2(config-std-nacl)# permit 192.168.0.0 0.0.0.255

Finally, we apply this route-map as a distribute-list in EIGRP for incoming routes to R2:

R2(config)# router eigrp 1 R2(config-router)# distribute-list route-map TEST_1 in

After applying, R2's routing table will only show:

D 192.168.0.0/24

This outcome occurs because:

The route-map has one permit statement matching R1_L0_PERMIT.
The access-list R1_L0_PERMIT explicitly permits 192.168.0.0/24.
All other networks are implicitly denied by the access-list and then by the route-map's implicit deny.

Combining Route-Map Permit with Access-List Deny

Let's try a different approach. We'll create an access-list R1_L0_DENY that denies 192.168.0.0/24:

R2(config)# ip access-list standard R1_L0_DENY R2(config-std-nacl)# deny 192.168.0.0 0.0.0.255

Then, we create a new route-map TEST_2 with a permit statement and this access-list as a match:

R2(config)# route-map TEST_2 permit 10 R2(config-route-map)# match ip address R1_L0_DENY

Applying TEST_2 to EIGRP as a distribute-list results in no routes in R2's routing table. This is because:

The route-map permit statement matches the access-list R1_L0_DENY.
R1_L0_DENY explicitly denies 192.168.0.0/24 and implicitly denies everything else.
Since nothing is permitted by the access-list, the route-map's permit action has no routes to permit, leading to the route-map's implicit deny taking effect on all routes.

If the goal was to deny 192.168.0.0/24 and permit everything else, a permit any statement would be needed in the access-list.

Route-Map Deny Statement with Access-List Permit

Now, let's reverse the route-map logic and use a deny statement. We'll reuse R1_L0_PERMIT:

Standard IP access list R1_L0_PERMIT 10 permit 192.168.0.0, wildcard bits 0.0.0.255

Create route-map TEST_3 with a deny statement:

R2(config)# route-map TEST_3 deny 10 R2(config-route-map)# match ip address R1_L0_PERMIT

Applying TEST_3 to EIGRP will initially result in no routes in R2's table. Here's why:

The route-map's deny statement matches 192.168.0.0/24 via R1_L0_PERMIT, so this network is denied.
All other networks don't match R1_L0_PERMIT (due to its implicit deny) and then hit the route-map's implicit deny.

To deny 192.168.0.0/24 but permit everything else, we add a second permit statement to TEST_3 with no match condition:

R2(config)# route-map TEST_3 permit 20

With this change, R2's routing table will show:

D 192.168.1.0/24 D 192.168.2.0/24 D 192.168.3.0/24

Statement 10 denies 192.168.0.0/24, and statement 20 (matching everything) permits the rest.

Cisco Route-Maps: Network Policy & Routing