It looks like you're applying the PBR at the global level and not at the interface level. Can't say I have any experience with that myself.<div><br></div><div>Here's what works for me:</div><div><br></div><div>
<div>ip policy prefer-direct-route</div><div>ip route 0.0.0.0 0.0.0.0 172.30.69.1</div><div>!</div><div>interface ve 5</div><div> ip address 172.30.67.3 255.255.255.128</div><div> ip policy frag-match-src</div><div> ip policy route-map WWW-DMZ</div>
<div> ip vrrp-extended vrid 7 </div><div> backup priority 210</div><div> ip-address 172.30.67.2</div><div> track-port e 2/1</div><div> track-port e 2/2</div><div> enable</div>
<div>!</div><div>access-list 100 permit ip 172.30.67.0 0.0.0.127 any </div><div>!</div><div>route-map WWW-DMZ permit 10</div><div> match ip address 100</div><div> set ip next-hop 172.30.67.1 </div><div><br></div><div>Scott</div>
<br><div class="gmail_quote">On Tue, Jun 15, 2010 at 11:34 AM, Lazuardi Nasution <span dir="ltr"><<a href="mailto:mrxlazuardin@gmail.com">mrxlazuardin@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi Scott,<br>
<br>
Following is the related config. I can do HTTP on both VIP at the same<br>
time but I only can do DNS and PING to VIP2 if VIP1 is disconnected.<br>
Please help.<br>
<br>
Best regards,<br>
<br>
<br><snip><br>
<div class="im"><br>
<br>
> From: "Scott T. Cameron" <<a href="mailto:routehero@gmail.com">routehero@gmail.com</a>><br>
> To: <a href="mailto:foundry-nsp@puck.nether.net">foundry-nsp@puck.nether.net</a><br>
</div>> Date: Tue, 15 Jun 2010 10:29:25 -0400<br>
<div><div></div><div class="h5">> Subject: Re: [f-nsp] Route-Map Problem<br>
> I don't know why you're seeing that, because the route-map's ACL shouldn't care about whether it's DNS or HTTP. It should just care about src/dst networks at worst.<br>
> Can you show the exact config you're using?<br>
> Scott<br>
><br>
> On Tue, Jun 15, 2010 at 12:36 AM, Lazuardi Nasution <<a href="mailto:mrxlazuardin@gmail.com">mrxlazuardin@gmail.com</a>> wrote:<br>
>><br>
>> Hi Scott,<br>
>><br>
>> I have done with HTTP, the PBR works for HTTP request. But, there is<br>
>> problem with DNS. It seem that DNS reply doesn't follow PBR. I can see<br>
>> that the VIP receives DNS<br>
>> request but I think the reply is forwarded to the wrong gateway. Any<br>
>> suggestion ? I have tried ip policy<br>
>> frag-match-src/frag-match-dest/frag-match-src-dest with no success.<br>
>><br>
>> Best regards,<br>
>><br>
>> > From: "Scott T. Cameron" <<a href="mailto:routehero@gmail.com">routehero@gmail.com</a>><br>
>> > To: <a href="mailto:foundry-nsp@puck.nether.net">foundry-nsp@puck.nether.net</a><br>
>> > Date: Fri, 28 May 2010 06:47:23 -0400<br>
>> > Subject: Re: [f-nsp] Route-Map Problem<br>
>> > The ServerIron platform is generally very sensitive to the order of things. I've had this exact same problem before -- and banged my head against the wall.<br>
>> > However, you are missing one important thing on your config: ip policy frag-match-source. This will insure that all packets are treated.<br>
>> ><br>
>> > I'd start over, removing all the relevant PBR lines. Enter in the ACL first, exit, write mem. Enter in the route-map, exit, write mem. Finally, add in the ip policy statements.<br>
>> > Scott<br>
>> ><br>
>> > On Wed, May 26, 2010 at 12:51 PM, Lazuardi Nasution <<a href="mailto:mrxlazuardin@gmail.com">mrxlazuardin@gmail.com</a>> wrote:<br>
>> >><br>
>> >> Dear you,<br>
>> >><br>
>> >> I get some problem to do some demo of ServerIron with PBR (route-map)<br>
>> >> feature. It seem that route-map command give no effect so the link<br>
>> >> become fail over, not active-active. My goal is each port can have its<br>
>> >> own next hop, disregard the routing table or default routes. Any<br>
>> >> suggestion ?<br>
>> >><br>
>> >> Best regards,<br>
>> >><br>
>> >><br>
>> >> Following is the script of my configuration.<br>
>> >><br>
>> >><br>
>> >> vlan 2 by port<br>
>> >> untagged ethe 1<br>
>> >> router-interface ve 2<br>
>> >><br>
>> >> vlan 3 by port<br>
>> >> untagged ethe 2<br>
>> >> router-interface ve 3<br>
>> >><br>
>> >> ip route 0.0.0.0 0.0.0.0 192.168.0.254 distance 10<br>
>> >> ip route 0.0.0.0 0.0.0.0 192.168.255.254<br>
>> >><br>
>> >> interface ve 2<br>
>> >> ip address 192.168.0.1 255.255.255.0<br>
>> >> ip policy route-map PBR<br>
>> >><br>
>> >> interface ve 3<br>
>> >> ip address 192.168.255.1 255.255.255.0<br>
>> >><br>
>> >> access-list 2 permit 192.168.0.0 0.0.0.255<br>
>> >> access-list 2 deny any<br>
>> >><br>
>> >> route-map PBR permit 10<br>
>> >> match ip address 2<br>
>> >> set ip next-hop 192.168.0.254<br>
>> >><br>
>> >><br>
>> >> Following is the "show version" command.<br>
>> >><br>
>> >><br>
>> >> Copyright (c) 1996-2009 Brocade Communications Systems, Inc.<br>
>> >> Boot Version 12.1.00T405 Oct 29 2009 10:12:19 PST label: dob12100<br>
>> >> Monitor Version 12.1.00T405 Oct 29 2009 10:12:19 PST label: dob12100<br>
>> >> System Version 12.1.00T403 Dec 17 2009 10:21:27 PST label: ASR12100<br>
>> >> AXP Version: 1.12 Dated: 2009/12/01 10:22:32<br>
>> >> PAX Version: 0.0 Dated: 2009/07/28 10:35:11<br>
>> >> MBRIDGE Version: 000b, Device ID # bebe<br>
>> >><br>
>> >> ==========================================================================<br>
>> >> Type: Stackable 16GC<br>
>> >> Backplane Serial #: SA19091395<br>
>> >> Chassis Serial #: Not-Present<br>
>> >> Part #: 46458-00DB<br>
>> >> Version #: 11b626-020202ff-111d8036-00<br>
>> >> ==========================================================================<br>
>> >> Active management module:<br>
>> >> 1499 MHz Power PC processor (version 00008021/0030) 599 MHz bus<br>
>> >> 512 KB Boot flash<br>
>> >> 131072 KB Code flash<br>
>> >> 2048 MB DRAM<br>
>> >> The system uptime is 9 minutes 39 seconds<br>
>> >> The system started at 04:21:03, GMT+00, Wed May 26 2010<br>
>> >><br>
>> >> The system - boot source: secondary, mode: warm startsoft reset, total<br>
>> >> resets:11 soft reset, total resets:11<br>
>> >><br>
>> >><br>
>> >> Following is the "show flash" command.<br>
>> >><br>
>> >><br>
>> >> Active management module:<br>
>> >> Compressed Pri Code size = 23321502, Version 12.1.00T401 Dec 17 2009<br>
>> >> 10:08:10 PST label: ASM12100<br>
>> >> Compressed Sec Code size = 24392549, Version 12.1.00T403 Dec 17 2009<br>
>> >> 10:21:27 PST label: ASR12100<br>
>> >> Used Configuration Flash Size=4469, Max Configuration Flash Size=1441790<br>
>> >><br>
>> >> Code flash:<br>
>> >> Size : 134217728 bytes<br>
>> >> Bytes Used : 54544222 bytes<br>
>> >> Bytes Free : 76808192 bytes<br>
>> >><br>
>> >> USB 0 drive:<br>
>> >> Size : 4102352896 bytes<br>
>> >> Bytes Used : 4096 bytes<br>
>> >> Bytes Free : 4102348800 bytes<br>
>> >><br>
>> >> No external USB drive found in system<br>
<br>
_______________________________________________<br>
foundry-nsp mailing list<br>
<a href="mailto:foundry-nsp@puck.nether.net">foundry-nsp@puck.nether.net</a><br>
<a href="http://puck.nether.net/mailman/listinfo/foundry-nsp" target="_blank">http://puck.nether.net/mailman/listinfo/foundry-nsp</a><br>
</div></div></blockquote></div><br></div>