White Papers

16 Using Policy Based Routing and Access Control Lists in a Virtualized Network
N3048
(VLAN 10, 20)
VLAN 10
VLAN 20
Servers X, Y, Z
Servers A, B, C
Using Policy Based Routing to redirect VLAN traffic Figure 4.
Two access lists are created. The first access list contains the source IP addresses of servers A, B, and C to
filter out these packets, since it is undesirable to reroute any server traffic. This traffic continues to be
routed using traditional routing.
The second access list contains destination IP addresses for servers X, Y, and Z so that any packet on VLAN
10 containing one of these IP addresses as a destination will receive a new “next-hop” and rerouted across
VLAN 20. When packets from servers A, B, or C have a destination IP address of servers X, Y, or Z, those
packets will never see this second access list because the Route-Map sequence “10” takes priority over
sequence “20” when both sequences match (note the sequences in the CLI commands below). Client
traffic however will never match sequence “10”, and only match sequence “20” when they are trying to
reach Servers X, Y, or Z.
Note: This example is policy-routing only the VLAN traffic that matches the criteria. It is not policy-
routing the entire VLAN (e.g. traffic from servers A, B, and C).
Figure 5 shows IP addresses on the network used for this example.