2.3. Configuring Route Policies with CLI

This section provides information to configure route policies using the command line interface.

2.4. Route Policy Configuration Overview

Route policies allow the configuration of IGMP group membership reports filtering rules.

2.4.1. When to Create Routing Policies

Route policies are created in the config>router context. There are no default route policies. Each route policy must be explicitly created and applied.

A route policy impacts the flow of packets within and through the router.

Route policies can be created to control filter IGMP membership reports from specific hosts and/or specific multicast groups.

Before a route policy is applied, analyze the policy purpose and be aware of the results (and consequences) when packets match the specified criteria and the associated actions and default actions, if specified, are executed. Membership reports can be filtered based on a specific source address.

2.4.2. Default Route Policy Actions

Each routing protocol has default behaviors for the import and export of routing information. Table 5 describes the default behavior for each routing protocol.

Table 5:  Default Route Policy Actions 

Protocol

Import

Export

OSPF

Not applicable. All OSPF routes are accepted from OSPF neighbors and cannot be controlled via route policies.

  1. Internal routes: All OSPF routes are automatically advertised to all neighbors.
  2. External routes: By default all non-OSPF learned routes are not advertised to OSPF neighbors

2.4.3. Policy Evaluation

Routing policy statements can consist of as few as one or several entries. The entries specify the matching criteria. The packet fields are compared to the first entry in the policy statement. If it matches, the specified entry action is taken, either accepted or rejected. If the action is to accept or reject the route, that action is taken and the evaluation of the route ends.

If the route does not match the first entry, the route is compared to the next entry (if more than one is configured) in the policy statement. If there is a match with the second entry, the specified action is taken. If the action is to accept or reject the route, that action is taken and the evaluation of the route ends, and so on.

Each route policy statement can have a default-action clause defined. If a default-action is defined for one or more of the configured route policies, the default actions should be handled in the following ways.

  1. The process stops when the first complete match is found and executes the action defined in the entry.
  2. If the packet does not match any of the entries, the system executes the default action specified in the policy statement.

Figure 1 shows an example of the route policy process.

Route policies can also match a specific route policy entry and continue to search for other entries within either the same route policy or the next route policy by specifying the next-entry option in the entry action command.

Figure 1:  Route Policy Process Example 

2.5. Basic Configurations

This section provides information to configure route policies and configuration examples of common tasks. The minimal route policy parameters that need to be configured are:

  1. Policy statement with the following parameters specified:
    1. At least one entry
    2. Entry action

The following is a sample route policy configuration output.

A:ALA-B>config>router>policy-options# info
----------------------------------------------
A:ALA-B>config>router>policy-options#info
----------------------------------------------
            prefix-list "host"
                prefix 10.0.0.0/8 longer
            exit
            prefix-list "group"
                prefix 10.6.6.6/32 exact
            exit
policy-statement "block-igmp"
                description "Reject-Reports-From-Specific-Group-And-Host"
                entry 1
                    from
                        host-ip "host"
                    exit
                    action next-entry
                    exit
                exit
                entry 2
                    from
                        group-address "group"
                    exit
                    action reject
                exit
                default-action accept 
                exit
            exit
            policy-statement "permit-igmp"
                description "Accept-Reports-From-Specific-Group-And-Host"
                entry 1
                    from
                        host-ip "host3"
                        group-address "group3"
                    exit
                    action accept
                    exit
                exit
                default-action reject
            exit
----------------------------------------------
A:ALA-B>config>router>policy-options#

2.6. Configuring Route Policy Components

This section describes the syntax needed to configure the route policy components.

2.6.1. Beginning the Policy Statement

Use the following syntax to begin a policy statement configuration. In order for a policy statement to be complete an entry must be specified (see Configuring an Entry).

CLI Syntax:
config>router>policy-options
begin
policy-statement name
description text

The following error message displays when the you try to modify a policy options command without entering begin first.

A:ALA-B>config>router>policy-options# policy-statement “allow all”
MINOR: CLI The policy
-options must be in edit mode by calling begin before any changes can be made.

The following example displays policy statement configuration command usage. These commands are configured in the config>router context.

Example:config>router# policy-options
policy-options# begin

There are no default policy statement options. All parameters must be explicitly configured.

2.6.2. Creating a Route Policy

To enter the mode to create or edit route policies, you must enter the begin keyword at the config>router>policy-options prompt. Other editing commands include the following.

  1. The commit command saves changes made to route policies during a session.
  2. The abort command discards changes that have been made to route policies during a session.

The following error message displays when the you try to modify a policy options command without entering begin first.

A:ALA-B>config>router>policy-options# policy-statement “allow all”
MINOR: CLI The policy
-options must be in edit mode by calling begin before any changes can 
A:ALA-B>config>router>policy-options# info
#------------------------------------------
# Policy
#------------------------------------------
 
        policy-options
            begin
            policy-statement "allow all"
description "General Policy"
...
            exit
exit
----------------------------------------------
A:ALA-B>config>router>policy-options#
 

2.6.3. Configuring a Default Action

Specifying a default action is optional. The default action controls those packets not matching any policy statement entries. If no default action is specified for the policy, then the action associated with the protocol to which the routing policy was applied is performed.

A policy statement must include at least one entry (see Configuring an Entry).

To enter the mode to create or edit route policies, you must enter the begin keyword at the config>router>policy-options prompt. Other editing commands include the following.

  1. The commit command saves changes made to route policies during a session.
  2. The abort command discards changes that have been made to route policies during a session.

2.6.4. Configuring an Entry

An entry action must be specified. The other parameters in the entry>action context are optional. Refer to the Route Policy Command Reference for the commands and syntax.

The following is a sample of entry parameters and includes the default action parameters which were displayed in the previous section.

A:ALA-B>config>router>policy-options# info
----------------------------------------------
            prefix-list "host"
                prefix 10.0.0.0/8 longer
            exit
            prefix-list "group"
                prefix 10.6.6.6/32 exact
            exit
            policy-statement "block-igmp"
                description "Reject-Reports-From-Specific-Group-And-Host"
                entry 1
                    from
                        host-ip "host"
                    exit
                    action next-entry
                    exit
                exit
                entry 2
                    from
                        group-address "group"
                    exit
                    action reject
                exit
                default-action accept 
                exit
            exit
----------------------------------------------
A:ALA-B>config>router>policy-options#
A:ALA-B>config>router>policy-options# info
----------------------------------------------
            prefix-list "host"
                prefix 10.0.0.0/8 longer
            exit
            prefix-list "group"
                prefix 10.6.6.6/32 exact
            exit
----------------------------------------------
A:ALA-B>config>router>policy-options#

2.7. Route Policy Configuration Management Tasks

This section describes the route policy configuration management tasks.

2.7.1. Editing Policy Statements and Parameters

Route policy statements can be edited to modify, add, or delete parameters. To enter the mode to edit route policies, you must enter the begin keyword at the config>router>policy-options prompt. Other editing commands include the following.

  1. The commit command saves changes made to route policies during a session.
  2. The abort command discards changes that have been made to route policies during a session.

The following is a sample changed configuration output.

A:ALA-B>config>router>policy-options# info
----------------------------------------------
            prefix-list "host"
                prefix 10.0.0.0/8 longer
            exit
            prefix-list "group1"
                prefix 10.6.6.8/32 exact
            exit
            policy-statement "block-igmp"
                description "Reject-Reports-From-Specific-Group-And-Host"
                entry 1
                    from
                        host-ip "host"
                    exit
                    action next-entry
                    exit
                exit
                entry 2
                    from
                        group-address "group1"
                    exit
                    action reject
                exit
                default-action accept 
                exit
            exit

2.7.2. Deleting an Entry

Use the following syntax to delete a policy statement entry.

CLI Syntax:
config>router>policy-options
begin
commit
abort
policy-statement name
no entry entry-id

The following shows the command usage to delete a policy statement entry.

Example:config>router>policy-options# begin
policy-options# policy-statement "1"
policy-options>policy-statement# no entry 4
policy-options>policy-statement# commit

2.7.3. Deleting a Policy Statement

Use the following syntax to delete a policy statement.

CLI Syntax:
config>router>policy-options
begin
commit
abort
no policy-statement name

The following shows the command usage to delete a policy statement.

Example:config>router>policy-options# begin
policy-options# no policy-statement 1
policy-options# commit