topic RE: Config iproute by origen in ExtremeSwitching (EXOS/Switch Engine)

Config iproute by origen

Daniel_Valera — Wed, 18 Jan 2017 01:50:00 GMT

Hi, I have a switch X450e-48p with image ExtremeXOS version 12.0.3.16 and my question is if can i configure various routes by origen?

I need configure various routes to internet in different gateways but separate depend of equipment inside the LAN.

regards

RE: Config iproute by origen

Nick_Yakimenko — Wed, 18 Jan 2017 01:56:00 GMT

is it all about BGP routes OR nat users OR balancing between 2 uplink ISPs?

RE: Config iproute by origen

Patrick_Voss — Wed, 18 Jan 2017 01:57:00 GMT

Hello Daniel,

I am having trouble understanding what you are looking for.

As far as configure by origin. The origin is how the switch learns a route (Ie OSPF, BGP...)

RE: Config iproute by origen

Daniel_Valera — Wed, 18 Jan 2017 01:57:00 GMT

Hi Patrick. Let me explain in another way.

I have a net with 192.168.1.0/24 and i want to the server 192.168.1.133 going to internet (0.0.0.0/0) by gateway 192.168.1.253 and the host 192.168.1.10-50 going to internet by gateway 192.168.1.254 for example

RE: Config iproute by origen

Nick_Yakimenko — Wed, 18 Jan 2017 01:57:00 GMT

in that case you should change the default gateway on your server (192.168.1.133) to 192.168.1.253 instead of 192.168.1.254
BTW which of them is your extreme switch?

RE: Config iproute by origen

Daniel_Valera — Wed, 18 Jan 2017 01:57:00 GMT

Hi Nick, If so configured right now, But the question is whether this traffic can be controlled in the sw Similar to cisco route-map policy

RE: Config iproute by origen

Nick_Yakimenko — Wed, 18 Jan 2017 01:57:00 GMT

.254 and .253 are different physical devices? What exact route-map policy you would like to convert into extreme format?

RE: Config iproute by origen

simon_bingham — Wed, 18 Jan 2017 02:07:00 GMT

I think he asking about Source based routing yes you can do it just be aware its a really easy way to generate routing loops

here is an example policy

The redirect entry is the one you need.

* CoreRouter1.113 # show policy REDIRECT
Policies at Policy Server:
Policy: REDIRECT

entry Exception {
if match any {
destination-address 172.27.237.244/30 ;
}
then {
count EXCEPTION ;
permit ;
}
}
entry redirect {
if match all {
source-address 172.27.237.248/30 ;
}
then {
redirect 172.27.237.242 ;
count REDIRECT_HIT ;
}
}
entry catch_all {
if match all {
}
then {
permit ;
count CATCHALL ;
}
}

RE: Config iproute by origen

Matthew_Helm1 — Wed, 18 Jan 2017 05:12:00 GMT

"You may want to create a static ARP entry for the redirect IP address, so that there will always be a cache entry."

RE: Config iproute by origen

Henrique — Wed, 18 Jan 2017 19:50:00 GMT

Hi Daniel,

I believe that Simon provided the information you need.

I would recommend you to check the articles below:

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-configure-PBR-on-EXOS-switches-for-...

On EXOS you can use a combination of match-conditions to redirect traffic from an specific SrcIP to a GW.

Please see the link below with a table with supported match-conditions (that's for EXOS 21.1 release but you can find the same information in the EXOS User Guide based on your EXOS version):

http://documentation.extremenetworks.com/exos/EXOS_21_1/ACL/r_acl-rule-syntax-details.shtml

Link to download the EXOS User Guide:

http://www.extremenetworks.com/support/documentation/

RE: Config iproute by origen

Daniel_Valera — Wed, 18 Jan 2017 19:50:00 GMT

Thanks Henrique

RE: Config iproute by origen

Daniel_Valera — Wed, 18 Jan 2017 19:50:00 GMT

Hi Henrique... so the policy maybe can i configure like this?

edit policy PBR.pol

entry TRAFIC_TO_WAN2 {
if {
source-address 192.168.100.x/32; (host1)
source-address 192.168.100.x/32; (host2)
}
then {
redirect 192.168.100.253; (Gateway to WAN2)
}
}

config access-list TRAFIC_TO_WAN2 vlan default ingress
enable diffserv examination port X (inside LAN port)
refresh policy PBR

configure iproute add default 192.168.100.254 (gateway to WAN1)

And the rest of the traffic can be configured a default route? Does the default route not affect the PBR policy?

thanks

Regards

RE: Config iproute by origen

Henrique — Wed, 18 Jan 2017 19:50:00 GMT

Hi Daniel,

You have to use different entries for different SrcIPs as follows:

edit policy PBR.pol

entry PBR_WAN2-Host1 {
if {
source-address 192.168.100.x/32; (host1)
}
then {
redirect 192.168.100.253; (Gateway to WAN2)
}
}
entry PBR_WAN2-Host2 {
if {
source-address 192.168.100.x/32; (host2)
}
then {
redirect 192.168.100.253; (Gateway to WAN2)
}
}

All the traffic that does not hit the ACL will be routed through default route.

The "refresh policy" command is used only when you have changed the policy file and need to update to the switch memory without needing to unconfig/config the ACL to the vlan or port.

Also, diffserv examination is not needed here, unless you are working with DSCP marking to perform QoS.

RE: Config iproute by origen

Daniel_Valera — Wed, 18 Jan 2017 19:50:00 GMT

great, i gonna make a test. regards

RE: Config iproute by origen

Nick_Yakimenko — Wed, 18 Jan 2017 19:50:00 GMT

I'm afraid that no traffic will hit the acl
what is the IP address of your extreme? Is it being used as default 192.168.100.254 gateway?

RE: Config iproute by origen

Daniel_Valera — Wed, 18 Jan 2017 19:50:00 GMT

Hi Nick, Do you say that politics will not work?

The sw extreme IP is 192.168.100.1
wan1: 192.168.100.254
wan2:192.168.100.253

RE: Config iproute by origen

Henrique — Wed, 18 Jan 2017 19:50:00 GMT

It should work. You can also add a counter to the ACL right after the "redirect" line to confirm as follows:

count ;

Use different counter names for each rule like:

count counthost1;

count counthost2;

RE: Config iproute by origen

Nick_Yakimenko — Wed, 18 Jan 2017 19:50:00 GMT

Daniel, what is the default gateway for your pc-s on subnet 192.168.100.*?

RE: Config iproute by origen

Daniel_Valera — Wed, 18 Jan 2017 19:50:00 GMT

Hi Nick, the default gateway is the switch 192.168.100.1

RE: Config iproute by origen

Daniel_Valera — Wed, 18 Jan 2017 19:50:00 GMT

Great. works correctly!

Thansk a lot