Assigning A Route Map To An Interface; Applying A Route Map To Router Traffic; Pbr Configuration Examples; Routing Traffic To A Security Appliance - HP ProCurve Secure Router 7203 dl Advanced Management And Configuration Manual

IP Routing—Configuring RIP, OSPF, BGP, and PBR
Configuring Policy-Based Routing
13-142

Assigning a Route Map to an Interface

In order to activate a routing policy, you must associate the route map with
an Ethernet or WAN interface. The router matches incoming packets to the
route map and, if it finds a match, routes them as indicated in the map.
(Otherwise, the router looks up the forwarding interface for the packet in its
routing table as usual.)
In other words, the router decides how to route traffic outgoing to the Internet
or a remote site according to the route maps applied to the Ethernet interfaces.
It decides how to route traffic incoming to the LAN according to the route
maps applied to WAN interfaces.
PBR on the ProCurve Secure Router is primarily designed to route traffic over
WAN connections in the most cost-effective manner. Therefore, you will
usually apply route maps to Ethernet interfaces.
To apply the route map, move to the interface configuration mode context and
enter this command:
Syntax: ip policy route-map <mapname>
For example:
ProCurve(config)# interface ethernet 0/1
ProCurve(config-eth 0/1)# ip policy route-map Outbound

Applying a Route Map to Router Traffic

You can also configure routing policies for traffic generated by the router
itself. Configure a route map as described for applying PBR to network traffic.
(See "Selecting Traffic for a Route Map Entry" on page 13-126 and "Setting the
Routing Policy in a Route Map Entry" on page 13-136.) Then apply the route
map to local router traffic with this global configuration mode command:
Syntax: ip local policy route-map <mapname>

PBR Configuration Examples

This section guides you through several scenarios for PBR.

Routing Traffic to a Security Appliance

You might configure PBR on your router when your network uses a security
appliance (such as an IDS) to monitor traffic from untrusted internal hosts.