Setting The Output Interface To The Null Interface - Brocade Communications Systems ICX 6650 Security Configuration Manual

Brocade(config)# route-map test-route permit 50
Brocade(config-routemap test-route)# match ip address 50
Brocade(config-routemap test-route)# set ip next-hop 192.168.2.1
Brocade(config-routemap test-route)# exit
The following commands configure the second entry in the route map. This entry (permit 51)
matches on the IP address information in ACL 51 above. For IP traffic from subnet 10.157.24.0/24,
this route map entry sets the next-hop IP address to 192.168.2.2.
Brocade(config)# route-map test-route permit 51
Brocade(config-routemap test-route)# match ip address 51
Brocade(config-routemap test-route)# set ip next-hop 192.168.2.2
Brocade(config-routemap test-route)# exit
The following commands configure the third entry in the test-route route map. This entry (permit
52) matches on the IP address information in ACL 52 above. For IP traffic from subnet
10.157.25.0/24, this route map entry sets the next-hop IP address to 192.168.2.3.
Brocade(config)# route-map test-route permit 52
Brocade(config-routemap test-route)# match ip address 52
Brocade(config-routemap test-route)# set ip next-hop 192.168.2.3
Brocade(config-routemap test-route)# exit
The following command enables PBR by globally applying the test-route route map to all interfaces.
Brocade(config)# ip policy route-map test-route
Alternatively, you can enable PBR on specific interfaces, as shown in the following example. The
commands in this example configure IP addresses in the three source subnets identified in ACLs
50, 51, and 52, then apply route map test-route to the interface.
Brocade(config)# interface ve 1
Brocade(config-vif-1)# ip address 10.157.23.1/24
Brocade(config-vif-1)# ip address 10.157.24.1/24
Brocade(config-vif-1)# ip address 10.157.25.1/24
Brocade(config-vif-1)# ip policy route-map test-route

Setting the output interface to the null interface

The following commands configure a PBR policy to send all traffic from 192.168.1.204/32 to the
null interface, thus dropping the traffic instead of forwarding it.
Brocade(config)# access-list 56 permit 10.168.1.204 0.0.0.0
The following commands configure an entry in a route map called "file-13". The first entry (permit
56) matches on the IP address information in ACL 56 above. For IP traffic from the host
10.168.1.204/32, this route map entry sends the traffic to the null interface instead of forwarding
it, thus sparing the rest of the network the unwanted traffic.
Brocade(config)# route-map file-13 permit 56
Brocade(config-routemap file-13)# match ip address 56
Brocade(config-routemap file-13)# set interface null0
Brocade(config-routemap file-13)# exit
The following command enables PBR by globally applying the route map to all interfaces.
Brocade(config)# ip policy route-map file-13
Alternatively, you can enable PBR on specific interfaces, as shown in the following example. The
commands in this example configure IP addresses in the source subnet identified in ACL 56, then
apply route map file-13 to the interface.
Brocade ICX 6650 Security Configuration Guide
53-1002601-01
Policy Based Routing
125