1、强策略路由与弱策略路由规则

  • 强策略路由：指定出接口和下一跳地址，处理流程为不查FIB表，直接通过指定的下一跳与出接口进行转发。
  • 弱策略路由：只指定下一跳地址不指定出接口，处理流程为使用指定的下一跳去查FIB表，查找成功则根据查到的表项转发；否则再使用报文中的目的IP地址去查FIB表，查找成功则根据查到的表项转发；否则丢弃。

2、实际应用

强策略路由与弱策略路由的区别_策略路由

3、核心配置

1）定义感应兴趣流

acl number 3000

rule 5 permit ip source 192.168.1.0 0.0.0.255

rule 10 deny ip source any

2）应用感应兴趣流

traffic classifier c1 operator or

if-match acl 3000

3）定义行为

traffic behavior b1

redirect ip-nexthop 100.1.1.2

4）定义策略

traffic policy p1

classifier c1 behavior b1

classifier c2 behavior b2

5）接口引用策略

interface GigabitEthernet0/0/0

ip address 10.1.1.2 255.255.255.0  

traffic-policy p1 inbound

注意：首先要确保路由的连通性，才能使用策略路由

3、详细配置

[r2]display current-configuration  

[V200R003C00]

#

sysname r2

#

snmp-agent local-engineid 800007DB03000000000000

snmp-agent  

#

clock timezone China-Standard-Time minus 08:00:00

#

portal local-server load flash:/portalpage.zip

#

drop illegal-mac alarm

#

wlan ac-global carrier id other ac id 0

#

set cpu-usage threshold 80 restore 75

#

acl number 2000  

rule 5 permit  

acl number 2001  

rule 5 permit  

#

acl number 3000  

rule 5 permit ip source 192.168.1.0 0.0.0.255  

rule 10 deny ip  

acl number 3001  

rule 5 permit ip source 192.168.2.0 0.0.0.255  

#

traffic classifier c2 operator or

if-match acl 3001

traffic classifier c1 operator or

if-match acl 3000

#

traffic behavior b2

redirect ip-nexthop 200.1.1.2

traffic behavior b1

redirect ip-nexthop 100.1.1.2

#

traffic policy p1

classifier c1 behavior b1

classifier c2 behavior b2

#

aaa  

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default  

domain default_admin  

local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

local-user admin service-type http

#

firewall zone Local

priority 15

#

interface GigabitEthernet0/0/0

ip address 10.1.1.2 255.255.255.0  

traffic-policy p1 inbound

#

interface GigabitEthernet0/0/1

ip address 100.1.1.1 255.255.255.0  

nat outbound 2000

#

interface GigabitEthernet0/0/2

ip address 200.1.1.1 255.255.255.0  

nat outbound 2001

#

interface NULL0

#

ip route-static 0.0.0.0 0.0.0.0 100.1.1.2

ip route-static 0.0.0.0 0.0.0.0 200.1.1.2

ip route-static 192.168.1.0 255.255.255.0 GigabitEthernet0/0/0 10.1.1.1

ip route-static 192.168.2.0 255.255.255.0 GigabitEthernet0/0/0 10.1.1.1

#

user-interface con 0

authentication-mode password

idle-timeout 0 0

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

return

[r2]