Understanding Cisco Route-Maps

Cisco Route-Maps are powerful tools on Cisco devices that leverage if-then logic to implement intricate network policies. They allow network administrators to match on various criteria and, optionally, perform actions based on those matches. This guide will help you in understanding Cisco Route-Maps, their configuration, and practical applications, making complex routing scenarios manageable. Whether you're a student or a professional, mastering route-maps is a crucial step in advanced Cisco networking.They are highly flexible, capable of everything from filtering routes to modifying attributes during redistribution.

What are Cisco Route-Maps and How Do They Work?

At its core, a route-map is a sequential list of statements, each with a sequence number, and either a permit or deny action. This structure is quite similar to access-lists.

Key Characteristics of Cisco Route-Maps:

• Sequential Processing: Route-maps process statements from top to bottom, stopping at the first match. Once a match occurs, the corresponding action is applied, and no further statements in that route-map are evaluated for that specific route or packet.
• Permit/Deny Actions: Each statement can be a permit or deny type. A permit statement means that if the match conditions are met, the route (or packet) is allowed to pass through the policy, and any set commands are applied. A deny statement means that if the match conditions are met, the route (or packet) is explicitly blocked.
• Match Conditions: These are the "if" part of the if-then logic. Route-maps can match on many different items, including:
• IP access-lists or prefix-lists (for matching network prefixes)
• BGP AS path lists, communities, or local preference
• Interface information
• Packet length
• Routing protocol metrics
• Source protocol or route-type
• Set Commands: These are the "then" part. If a match occurs in a permit statement, set commands can modify various attributes of the route or packet. Examples include:
• Changing routing protocol metrics (e.g., for OSPF or EIGRP redistribution)
• Setting BGP attributes (e.g., local preference, AS path, community)
• Modifying the next-hop IP address (for Policy-Based Routing)
• Setting the DSCP value of an IP packet
• Applying a redistribution tag
• Implicit Deny: Just like access-lists, route-maps have an invisible implicit deny at the very end. If a route or packet processes through all statements without finding a match, it will be denied by this implicit statement.
• Empty Statement: A route-map statement without any match condition is considered to match everything.
• Multiple Match Conditions: If a single route-map statement includes multiple match conditions, they work as a logical OR. If any of the specified match conditions are met, the statement is considered a match.
• Multiple Set Commands: You can configure multiple set commands within a single route-map statement.

Basic Configuration of Cisco Route-Maps

Let's explore how to configure route-maps with practical examples, demonstrating the impact of permit and deny statements in combination with access-lists. We'll use EIGRP distribute-lists for simplicity in these examples.

Match Condition with Permit Statement

This is the most common scenario: permitting specific networks based on an access-list. Imagine we want to permit only 192.168.0.0/24.

1. Create an Access-List:

R2(config)# ip access-list standard R1_L0_PERMIT
R2(config-std-nacl)# permit 192.168.0.0 0.0.0.255

2. Configure the Route-Map: We'll name it TEST_1 and use a permit action for sequence 10, matching our access-list.

R2(config)# route-map TEST_1 permit 10
R2(config-route-map)# match ip address R1_L0_PERMIT

3. Apply to EIGRP:

R2(config)# router eigrp 1
R2(config-router)# distribute-list route-map TEST_1 in

Result: Only 192.168.0.0/24 will appear in R2's routing table. Why? The route-map permits 192.168.0.0/24 based on the access-list. All other networks are implicitly denied by the access-list's implicit deny and subsequently by the route-map's implicit deny (since there are no other route-map statements).

Impact of Access-List Deny with Route-Map Permit

This example often causes confusion. Let's see what happens if the access-list itself uses a deny statement, but the route-map statement is permit.

1. Create a Deny Access-List:

R2(config)# ip access-list standard R1_L0_DENY
R2(config-std-nacl)# deny 192.168.0.0 0.0.0.255

2. Configure the Route-Map: TEST_2 with permit action, matching the deny access-list.

R2(config)# route-map TEST_2 permit 10
R2(config-route-map)# match ip address R1_L0_DENY

3. Apply to EIGRP:

R2(config)# router eigrp 1
R2(config-router)# distribute-list route-map TEST_2 in

Result: No routes will appear in R2's routing table. Here's why:

• The access-list R1_L0_DENY explicitly denies 192.168.0.0/24. For all other networks, the access-list has an implicit deny any.
• Since the access-list denies everything, the match ip address R1_L0_DENY condition in the route-map never finds a permit match within the access-list to trigger its own permit action.
• Consequently, the route-map statement doesn't match anything, and all routes fall through to the route-map's implicit deny any.

To deny only 192.168.0.0/24 and permit everything else using this structure, you'd need to add a permit any statement to your access-list.

Match Condition with Deny Statement in Route-Map

Now, let's reverse the logic at the route-map level. We'll use a deny statement in the route-map, combined with a permit access-list.

1. Use Previous Permit Access-List: We'll reuse R1_L0_PERMIT (which permits 192.168.0.0/24).
2. Configure the Route-Map: TEST_3 with deny action, matching the permit access-list.

R2(config)# route-map TEST_3 deny 10
R2(config-route-map)# match ip address R1_L0_PERMIT

3. Apply to EIGRP:

R2(config)# router eigrp 1
R2(config-router)# distribute-list route-map TEST_3 in

Result: Initially, no routes appear. The first route-map statement matches 192.168.0.0/24 and then explicitly denies it. All other routes are not matched by statement 10 and thus fall to the route-map's implicit deny.

To deny 192.168.0.0/24 but permit everything else, we need an additional route-map statement:

R2(config)# route-map TEST_3 permit 20

This empty route-map statement (no match condition) matches everything else. After this change, all networks except 192.168.0.0/24 will appear in R2's routing table.

Route-Map Deny and Access-List Deny (Double Negative)

This scenario often confuses users, as a double negative doesn't result in a permit here.

1. Use Previous Deny Access-List: R1_L0_DENY (which denies 192.168.0.0/24).
2. Configure the Route-Map: TEST_4 with a deny action, matching R1_L0_DENY.

R2(config)# route-map TEST_4 deny 10
R2(config-route-map)# match ip address R1_L0_DENY

3. Apply to EIGRP:

R2(config)# router eigrp 1
R2(config-router)# distribute-list route-map TEST_4 in

Result: Nothing appears. Why? The access-list R1_L0_DENY denies 192.168.0.0/24 and implicitly denies everything else. Because there are no permit statements in the access-list, the match ip address R1_L0_DENY condition in the route-map never finds anything to match against. Therefore, no routes are processed by statement 10, and they all fall to the route-map's implicit deny any.

To allow other routes, you would again add an empty permit statement:

R2(config)# route-map TEST_4 permit 20

This would then cause 192.168.0.0/24 to be denied (by the access-list) and all other routes to be permitted.

Multiple Match Conditions in Cisco Route-Maps

Route-maps can evaluate multiple conditions within a single statement. When you specify multiple match clauses in one route-map statement, they function as a logical OR. If any of the conditions are met, the statement is considered a match.

1. Create Multiple Access-Lists:

R2(config)# ip access-list standard R1_L1_PERMIT
R2(config-std-nacl)# permit 192.168.1.0 0.0.0.255
R2(config)# ip access-list standard R1_L2_PERMIT
R2(config-std-nacl)# permit 192.168.2.0 0.0.0.255

2. Configure Route-Map with Multiple Matches:

R2(config)# route-map MULTIPLE_MATCH permit 10
R2(config-route-map)# match ip address R1_L1_PERMIT R1_L2_PERMIT

3. Apply to EIGRP:

R2(config)# router eigrp 1
R2(config-router)# distribute-list route-map MULTIPLE_MATCH in

Result: Both 192.168.1.0/24 and 192.168.2.0/24 will be present in R2's routing table.

Utilizing the set Command in Cisco Route-Maps

The true power of route-maps lies in their ability to modify route attributes using the set command. This transforms them from simple filters into policy enforcement tools. We'll demonstrate this by redistributing a new loopback interface into EIGRP and setting its metric.

1. Create a New Loopback Interface and Access-List (on R1):

R1(config)# interface Loopback4
R1(config-if)# ip address 172.16.1.1 255.255.255.0
R1(config)# ip access-list standard R1_L4
R1(config-std-nacl)# permit 172.16.1.0 0.0.0.255

2. Configure Route-Map with set Command: We'll use SET route-map to match R1_L4 and set specific EIGRP composite metric values (bandwidth, delay, reliability, load, MTU).

R1(config)# route-map SET permit 10
R1(config-route-map)# match ip address R1_L4
R1(config-route-map)# set metric 1500 10 255 255 1500

3. Redistribute into EIGRP (on R1):

R1(config)# router eigrp 1
R1(config-router)# redistribute connected route-map SET

Verification (on R2): show ip route eigrp 172.16.1.0 will show the redistributed route with the metric we set. You can modify the set metric values in the route-map, and R2 will reflect the changes, confirming the policy is active.

Common set command options include set metric, set local-preference, set community, set next-hop, set tag, and many more, depending on the routing protocol context.

Key Takeaways for Cisco Route-Maps

To summarize your understanding of Cisco Route-Maps:

• Route-maps are executed sequentially; the first match applies its action and processing stops.
• Every route-map implicitly ends with a deny any statement.
• A permit in a route-map allows the matched route/packet to proceed, applying any set commands.
• A deny in a route-map discards the matched route/packet.
• An empty route-map statement (no match conditions) will match all routes or packets.
• Multiple match conditions in a single statement act as a logical OR.
• The set command provides powerful capabilities to alter route attributes, making route-maps essential for advanced network policy control.

Frequently Asked Questions (FAQ) about Cisco Route-Maps

What is the primary purpose of a Cisco route-map?

A Cisco route-map is primarily used for implementing network policies by applying if-then logic to routing updates or packet forwarding. It allows administrators to selectively match network traffic or routes based on various criteria and then perform specific actions, such as filtering, modifying attributes, or redirecting traffic.

How does the implicit deny work in a route-map?

Similar to access-lists, a route-map includes an invisible implicit deny statement at the end of its configuration. If a route or packet is processed by the route-map and doesn't match any of the explicitly configured permit or deny statements, it will be denied by this implicit statement and discarded.

Can I use multiple match conditions in a single route-map statement?

Yes, you can specify multiple match conditions within a single route-map statement. When multiple match conditions are configured in the same statement, they behave as a logical OR. This means that if any of the specified conditions are met, the entire route-map statement is considered a match, and its action (permit/deny) and set commands are applied.

What happens if I configure a route-map statement without any match conditions?

If you configure a route-map statement without any match conditions, that statement is considered to match everything. This is often used as a final permit statement (e.g., route-map MYMAP permit 20) after specific deny statements, to allow all other traffic or routes that were not explicitly denied earlier in the route-map.

How do I remove a route-map from a router configuration?

To completely remove a route-map, you use the no route-map command followed by the route-map name. For example, no route-map TEST_1. Before removing it, ensure you first remove any configurations where the route-map is applied (e.g., no distribute-list route-map TEST_1 in within a routing protocol configuration).