Overview

Normal routing forwards packets based on the destination IP address using information derived from statically configured routes or from dynamic routes added during runtime by features such as IPsec or OSPF. Instead, policy-based routing allows routes to be chosen based on other traffic characteristics in addition to the destination IP.

Policy-based routing allows the following:

Policy-based Routing Components

Creating Alternate Routing Tables

Alternate routing tables contain the same information for describing routes as main. Additionally, they have an extra property called Ordering. The Ordering property decides how route lookup is performed using alternate tables in conjunction with the main routing table. This is described further under the heading "The Ordering Property" below.

System:/> add RoutingTable my_pbr_table Ordering=First

System:/> cc RoutingTable my_pbr_table

System:/RoutingTable/my_pbr_table> add Route
			Interface=if3
			Network=my_network

System:/RoutingTable/my_pbr_table> cc
System:/> 

Creating Routing Rules

A RoutingRule has a number of filtering properties that are similar to those used in an IP rule. A rule can trigger on a type of service (HTTP for example) in combination with the specified source interface and source/destination network. Routing rules cannot be filtered on destination interface as it would not be known before route lookup.

When looking up routing rules, the rule set is searched from top to bottom and it is the first matching rule found that is triggered.

System:/> cc PBRRules

System:/PBRRules> add RoutingRule
			Service=http
			SourceInterface=any
			SourceNetwork=all-nets-ip4
			DestinationNetwork=my_network
			ForwardRoutingTable=my_pbr_table
			ReturnRoutingTable=my_pbr_table
			Name=my_routing_rule

System:/PBRRules> show

RoutingRule

  # Name Source interface Source network Destination network Service
  - ---- ---------------- -------------- ------------------- ------------
+ 1 my   any              all-nets       my_network          http

System:/PBRRules> cc
System:/> 

Routing Rules can use IPv4 or IPv6 Addresses

However, both the source and destination network must be either IPv4 or IPv6. It is not permissible to combine IPv4 and IPv6 addresses in a single rule. For further discussion of this topic, see Section 5.4, IPv6 Support.

For this reason it is recommended to not use the all-nets address object in a routing rule. It is better to use either all-nets-ip4 or all-nets-ip6 so that it is clear what kind of IP addresses the rule applies to.

The Forward and Return Routing Table can be Different

Consider the example of a firewall with two hypothetical interfaces wan1 and wan2 connected to two ISPs and with a protected network if1_net on the if1 interface. All IP addresses are assumed to be IPv4.

Assume, that there are two routing tables, the main routing table and an alternate routing table called isp2_rt. The contents of these tables are shown below:

The main routing table

The isp2_rt routing table

If traffic coming through wan2 is to have access to if1_net then a routing rule needs to be defined as follows:

This rule allows the forward traffic received through the wan2 interface to find the route for if1_net in the main routing table. The return traffic will use the isp2_rt table so it can reach the initiator of the flow.

With IPv4, this example would most likely have some address translation rules since if1_net will probably be a private IP network. For simplicity, these details have been omitted.

Interface Routing Table Membership

The difference with this method of explicit association is that the administrator cannot specify the service, such as HTTP, for which the lookup will apply. Routing rules allow a more fine-grained approach to routing table selection by being able to also select a specific service and network filter.

The Routing Table Selection Process

The Ordering Property

The three available options for the Ordering property are:

Important: Check that a default route exists

A common mistake when setting up policy-based routing with First or Last ordering is the absence of a default route with a destination network of all-nets-ip4 or all-nets-ip6 in the main routing table. If there is no matching route, the absence of a default route will mean that the traffic will be dropped. The need for a default route applies regardless if the routing table is selected by using a routing rule, or by using the RoutingTableMembership property.

Setting Up Policy-based Routing with Multiple ISPs

Now, suppose that are two different ISPs, ISP A with the gateway address isp_A_gw, and ISP B with the gateway address isp_B_gw. These ISPs are connected to the firewall interfaces wan1 and wan2 respectively.

The requirement is to have hosts and clients on if1_net use only ISP A for Internet connection. Similarly, if2_net is to use only ISP B.

The contents of the main routing table will be as follows:

An alternate routing table rt2 is created with the following entry:

The table rt2 has its Ordering property set to Last, which means that it will only be consulted if a lookup in the main routing table gives a match with the default all-nets route.

The policy-based routing rule set contains a single rule that triggers on traffic coming from the if2_net network bound for the public Internet:

When the configuration objects listed above are created, the result is that flows originating from clients and hosts on if1_net and if2_net to the public Internet will be routed to the intended ISP.

Although routed correctly, the appropriate IPRule objects that are needed to allow these flows have been omitted from the description above.