Monday, June 11, 2012

Dual-ISP Policy Based Routing: Cisco Route-Maps On A Core Switch To Re-Route HTTP/HTTPS Traffic

I wanted to divert one IP address across a second Internet connection that we have just put in at a customer site.  We felt like we needed to do some testing, so we decided to test with a pc with an IP address of 192.168.20.10.  We also decided that if we wanted to reach the 70.1.1.0 network on the public side, we needed this traffic to NOT go across the new Internet connection.  Here is the topology:

So, here is how I did it.
First, I created my access list to define what traffic needs to be routed across to the new Internet connection.  Notice lines two and three
access-list 105 deny ip host 192.168.20.10 70.1.1.0 0.0.0.255   <------ Do NOT set the next hop if this criteria matches
access-list 105 permit tcp host 192.168.20.10 any eq 80              <------ Do set the next hop if this criteria matches
access-list 105 permit tcp host 192.168.20.10 any eq 443            <------ Do set the next hop if this criteria matches
access-list 105 deny ip any any                                                      <------ Do NOT set the next hop if this criteria matches

Next, configure your route-map to say that it must match ACL 105 and set the next hop to be 192.168.20.100.
route-map HTTP permit 10
 match ip address 105
 set ip next-hop 192.168.20.100

Next, apply it to the interface vlan 13.
interface Vlan13
 ip policy route-map HTTP