Route-maps are generic mechanisms which you can use in many configurations, mainly the redistribute command and for PBR. You can use PBR to force traffic to paths that are different from the ones in the normal forwarding/route table. You can use PBR to control traffic based on ToS, packet size and type, and source address, among others
These are some of the differences between route-maps and ACLs:
- Route-maps frequently use ACLs as matching criteria.
- The main result from the evaluation of an access list is a yes or no answer—an ACL either permits or denies input data. Applied to redistribution, an ACL determines if a particular route can (route matches ACLs permit statement) or can not (matches deny statement) be redistributed. Typical route-maps not only permit (some) redistributed routes but also modify information associated with the route, when it is redistributed into another protocol. See the Route-Map Basics section of this document for route-map modification examples.
- Route-maps are more flexible than ACLs and can verify routes based on criteria which ACLs can not verify. For example, a route-map can verify if the type of route is internal or if it has a specific tag.
- Each ACL ends with an implicit deny statement, by design convention; there is no similar convention for route-maps. If the end of a route-map is reached during matching attempts, the result depends on the specific application of the route-map. Fortunately, route-maps that are applied to redistribution behave the same way as ACLs: if the route does not match any clause in a route-map then the route redistribution is denied, as if the route-map contained deny statement at the end.
- Route-maps can have permit and deny clauses. In route-map ospf-to-eigrp, there is one deny clause (with sequence number 10) and two permit clauses. The deny clause rejects route matches from redistribution. Therefore, these rules apply:
- If you use an ACL in a route-map permit clause, routes that are permitted by the ACL are redistributed.
- If you use an ACL in a route-map deny clause, routes that are permitted by the ACL are not redistributed.
- If you use an ACL in a route-map permit or deny clause, and the ACL denies a route, then the route-map clause match is not found and the next route-map clause is evaluated.
Remarques : par l’action par default est permit.
router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
router(config)#route-map TEST-LOOP ?
<0-65535> Sequence to insert to/delete from existing route-map entry
deny Route map denies set operations
permit Route map permits set operations
<cr>router(config)#route-map TEST-LOOP 40
router(config-route-map)#end
router#sh run | inc route-map TEST-LOOP
route-map TEST-LOOP deny 5
route-map TEST-LOOP permit 10
route-map TEST-LOOP permit 40
router#
- A match or set command in each clause can be missed or repeated several times, if one of these conditions exist:
- If several match commands are present in a clause, all must succeed for a given route in order for that route to match the clause (in other words, the logical AND algorithm is applied for multiple match commands).
- If a match command refers to several objects in one command, either of them should match (the logical OR algorithm is applied). For example, in the match ip address 101 121 command, a route is permitted if it is permitted by access list 101 or access list 121.
- If a match command is not present, all routes match the clause. In the previous example, all routes that reach clause 30 match; therefore, the end of the route-map is never reached.
- If a set command is not present in a route-map permit clause then the route is redistributed without modification of its current attributes.
Do not configure a set command in a deny route-map clause because the deny clause prohibits route redistribution—there is no information to modify.
A route-map clause without a match or set command performs an action. An empty permit clause allows a redistribution of the remaining routes without modification. An empty deny clause does not allows a redistribution of other routes.
Port security can only be configured on static access ports or trunk ports. A secure port cannot be a dynamic access port.
interopnetwork 