Configuring PBR

Context

After a redirection action is configured, a switch redirects packets matching traffic classification rules to a specified next-hop address.

A traffic policy containing the redirection action can be used globally, on an interface, or in a VLAN in the inbound direction.

Pre-configuration Tasks

Before configuring PBR, complete the following tasks:

Configure IP addresses for interfaces and configure routing protocols to ensure connectivity.
Configure an ACL to classify traffic.

Procedure

Configure a traffic classifier.

For details about configuring a traffic classifier, see Configuring a Traffic Classifier in "MQC Configuration" in the S2720, S5700, and S6700 V200R019C10 Configuration Guide - QoS.
Configure a traffic behavior.
1. Run traffic behavior behavior-name
  
  A traffic behavior is created and the traffic behavior view is displayed; alternatively, the view of an existing traffic behavior is displayed.
2. Run the following commands as required.
  - Run redirect [ vpn-instance vpn-instance-name ] ip-nexthop { ip-address [ track-nqa admin-name test-name ] } &<1-4> [ forced | low-precedence ] ^*
    
    The switch is configured to redirect packets matching traffic classification rules to the specified next-hop IP address.
    
    A maximum of four next-hop IP addresses can be configured in a traffic behavior. If multiple next-hop IP addresses are configured, the switch determines the active and standby links according to the sequence in which next-hop IP addresses were configured. The next-hop IP address that was configured first has the highest priority and the link for this next hop is used as the active link. Links for other next hops are used as standby links. If the active link goes Down, the link for the next hop with the highest priority functions as the new active link to transmit traffic. If the previous active link recovers from the fault, traffic is switched back to this previous active link.
    
    Configuring redirection can implement PBR.
    
    If the low-precedence parameter is specified, the priority of redirection-based PBR is lowered below that of statically configured routes or routes generated by dynamic routing protocols (rather than being higher by default).
  - Run redirect [ vpn-instance vpn-instance-name ] ipv6-nexthop { ipv6-address | link-local link-local-address interface interface-type interface-number } &<1-4> [ forced ]
    
    The switch is configured to redirect IPv6 packets matching traffic classification rules to the configured next-hop address.
  - Run redirect [ vpn-instance vpn-instance-name ] ip-multihop { nexthop ip-address } &<2-4>
    
    Or run redirect [ vpn-instance vpn-instance-name ] ip-multihop acl-ip-pool-name
    
    The switch is configured to redirect packets matching traffic classification rules to one of the configured next hops.
    
    If multiple next hops are specified, the switch redirects packets through equal-cost routes for load balancing.
    
    If the outbound interface corresponding to a next-hop IP address goes Down or a route changes, the switch transmits traffic to the outbound interface corresponding to an available next hop.
    
    If the switch has no ARP entry matching the specified next-hop IP address, the redirect ip-multihop command can be used but redirection does not take effect (the switch continues to forward packets to the original destination) until the switch obtains the corresponding ARP entry.
  - Run redirect [ vpn-instance vpn-instance-name ] ipv6-multihop { ipv6-address | link-local link-local-address interface interface-type interface-number } &<2-4>
    
    Or run redirect [ vpn-instance vpn-instance-name ] ipv6-multihop acl6-ip-pool-name
    
    The switch is configured to redirect IPv6 packets matching traffic classification rules to one of the configured next hops.
    
    If multiple next hops are specified, the switch redirects packets through equal-cost routes for load balancing.
3. (Optional) Run statistic enable
  
  The traffic statistics collection function is enabled.
4. Run quit
  
  Exit from the traffic behavior view.
5. Run quit
  
  Exit from the system view.
Configure a traffic policy.

For details about configuring a traffic policy, see Configuring a Traffic Policy in "MQC Configuration" in the S2720, S5700, and S6700 V200R019C10 Configuration Guide - QoS.
Apply the traffic policy.
- Apply a traffic policy to an interface.
  1. Run system-view
    
    The system view is displayed.
  2. Run interface interface-type interface-number
    
    The interface view is displayed.
  3. Run traffic-policy policy-name inbound
    
    A traffic policy is applied to the inbound direction of the interface.
- Apply a traffic policy to a VLAN.
  1. Run system-view
    
    The system view is displayed.
  2. Run vlan vlan-id
    
    The VLAN view is displayed.
  3. Run traffic-policy policy-name inbound
    
    A traffic policy is applied to the VLAN.
    
    The system then applies the policy to the incoming packets that are sent from the VLAN and match traffic classification rules.
- Apply a traffic policy globally.
  1. Run system-view
    
    The system view is displayed.
  2. Run traffic-policy policy-name global inbound [ slot slot-id ]
    
    A traffic policy is applied globally.

Verifying the Configuration

Run the display traffic classifier user-defined [ classifier-name ] command to check the traffic classifier configuration.
Run the display traffic behavior user-defined [ behavior-name ] command to check the traffic behavior configuration.
Run the display traffic policy user-defined [ policy-name [ classifier classifier-name ] ] command to check the configuration of a specified user-defined traffic policy.
Run the display traffic-applied [ interface [ interface-type interface-number ] | vlan [ vlan-id ] ] { inbound | outbound } [ verbose ] command to check information about ACL-based simplified and MQC-based traffic policies applied to the system, a VLAN, or an interface.

The display traffic-applied command cannot be used to check information about ACL-based simplified and MQC-based traffic policies applied to a sub-interface. However, traffic policies can be applied to a sub-interface.
Run the display traffic policy { interface [ interface-type interface-number [.subinterface-number ] ] | vlan [ vlan-id ] | ssid-profile [ ssid-profile-name ] | global } [ inbound | outbound ] command to check the traffic policy configuration.

Only the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S support sub-interfaces.

Only the S5720-HI, S5730-HI, S5731-H, S5731S-H, S5732-H, S6720-HI, S6730S-H, and S6730-H support ssid-profile [ ssid-profile-name ].
Run the display traffic-policy applied-record [ policy-name ] command to check the application records of a specified traffic policy.