Route-map Questions

Route-map Quick Summary

Route-maps work like the “if-then” programming solution for networking devices. A route-map allows you to check for certain match conditions and (optionally) set a value. Route maps are commonly used for route redistribution, Policy Based Routing and BGP policy implementation.

Route maps have the following common characteristics:

Route maps are executed in the order of the lowest sequence number to the highest. You can edit or modify maps by using the sequence number.

+ If a match is found within a route map instance, execution of further route map instances stops.
+ You can use route maps to permit or deny the information found true by the match statements.
+ If route maps are applied in a policy-routing environment, packets that do not meet the match criteria are then forwarded according to the routing table.
+ If there is no match statement in the route map instance, all routes and packets are matched. The set statement will apply to all routes or packets. In other words, a rule with no match command will match anything.
+ If there is not a corresponding ACL to the match statement in the route map instance, all routes are matched. The set statement, in turn, applies to all routes.
+ As with ACLs, an implicit deny is included at the end of the route map policy.

Reference: https://www.ciscopress.com/articles/article.asp?p=102092

The router will consider multiple match conditions in the same line as a logical OR. This means that, if at least one of them is true, the line matches. Instead, match conditions on different lines are a logical AND: they must all be true for the rule to match. For example:

//Match one of them to be true
match source-protocol ospf 1 eigrp 65000 
match tag 20

This means that we are matching routes with tag 20 coming from either OSPF 1 or EIGRP 65000.

Permit and Deny Clauses

If a route-map is used for redistribution purpose:

– ACL permit + route map permit: routes are redistributed
– ACL permit + route map deny: routes are not redistributed
– ACL deny + route map permit or deny: the route map clause is not matched, and the next route-map clause is evaluated.

Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa912/configuration/general/asa-912-general-config/route-maps.pdf

Thus, we can summarize in the following four cases.

Deny Access-list Entry Example

The following example illustrates how to stop processing a given route map sequence, and to jump to the next sequence. Packets arriving from source 1.1.1.1 will skip sequence 10 and jump to sequence 20. All other packets from subnet 1.1.1.0 will follow the set statement in sequence 10.

access-list 1 deny ip 1.1.1.1
access-list 1 permit ip 1.1.1.0 0.0.0.255
access-list 2 permit ip 1.1.1.1
access-list 2 permit ip 2.2.2.2
!
interface fastethernet 3/1
 ip policy route-map Texas
!
route-map Texas permit 10
 match ip address 1
 set ip next-hop 3.3.3.3
!
route-map Texas permit 20
 match ip address 2
 set ip next-hop 3.3.3.5

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/pbroute.pdf