Policy-Based-Routing on vlan51

Policy Based Routing (PBR) on HPE Aruba ArubaOS-Switch

Mon, 01 Jan 2024 00:00:00 +0000

How to configure Policy Based Routing (PBR) on HPE Aruba ArubaOS-Switch. Applies to the 3800, 5400zl v2, and 8200 series. PBR can only be applied inbound.

Three components: a class to match traffic, a policy to define the action, and a VLAN/port to apply it.

Scenario #

Traffic from 192.168.10.0/24 to 10.0.0.0/24 uses gateway 2.2.2.1. All other traffic uses 1.1.1.1.

PBR topology — local and internet breakout

Class configuration #

cli

class ipv4 "CLASS-192.168-LOCAL-BREAKOUT"
 5 match ip 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255
 exit

class ipv4 "CLASS-192.168-INTERNET-BREAKOUT"
 5 match ip 192.168.10.0 0.0.0.255 0.0.0.0 255.255.255.255
 exit

Policy configuration #

cli

policy pbr "POLICY-INTERNET-BREAKOUT"
 5 class ipv4 "CLASS-192.168-LOCAL-BREAKOUT"
 action ip next-hop 2.2.2.1
 exit
 6 class ipv4 "CLASS-192.168-INTERNET-BREAKOUT"
 action ip next-hop 1.1.1.1
 exit
 exit

Apply to VLAN interface #

cli

vlan 10
 name "192.168.10.0-VLAN"
 ip address 192.168.10.254 255.255.255.0
 service-policy "POLICY-INTERNET-BREAKOUT" in
 exit

Important: locally connected networks #

If other VLANs are on the same switch, PBR will break inter-VLAN routing because it overrides the routing table for matched traffic. Fix this by pointing the local class next-hop at the switch’s own IP:

Policy Based Routing (PBR) on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to configure Policy Based Routing (PBR) on HPE Comware v7. Traffic is matched by ACLs and redirected to an alternative next-hop, overriding the routing table.

Scenario #

The setup is identical to the ArubaOS-Switch PBR guide. The switch (.254) has a default gateway of 2.2.2.1.

PBR topology: local breakout via the default gateway, internet via the firewall at 1.1.1.1

From 192.168.10.0/24: internal traffic (to 10.0.0.0/8 or 192.168.0.0/16) uses the normal routing table, internet traffic is sent to 1.1.1.1.

Policy Based Routing Within a VRF/VPN-Instance on HPE Comware v7

Mon, 01 Jan 2024 00:00:00 +0000

How to configure PBR within a VRF/VPN-Instance on HPE Comware v7. Useful in multi-tenant environments where traffic must be steered within an isolated routing domain.

PBR within a VRF is only supported on Comware v7 — not Comware v5.

Only a few changes are needed compared with PBR outside a VRF: the VPN-Instance has to be referenced in the next-hop and in the ACL rules. A VPN-Instance is Comware’s name for a VRF.