Measuring with Policy Based Routing

Measuring with PBR involves adding the following to your edge routers:

• GRE tunnel interfaces that will connect to the USTAT modules
• Route maps for policy routing on the tunnels
• Routing between the edge routers and the CNA system, including BGP peering and routing to the USTAT VIPs

Once the router changes are in place, the CNA system must be configured to actively measure the VPN endpoints. For the purposes of describing the CNA configuration process using widely understood terminology, this section assumes a simple, generic network that uses Cisco equipment as its edge routers.

The configuration commands in this chapter are Cisco IOS commands. (For more information about Cisco IOS syntax, see the Cisco IOS Software Documentation section under Technical Documents at http://www.cisco.com.)

Each CNA USTAT module needs to be associated with a different tunnel interface on the Cisco router, so you will need to create at least two tunnels, one on each router.

Set up the first GRE tunnel interface on your Cisco edge router by inserting the following commands into your router's configuration:

interface TunnelA
 
 description “Measurements to ISP A”
 
 ip address 10.50.1.1 255.255.255.252
 
 ip policy route-map CNA-measurements
 
 tunnel source 172.28.1.1
 
 tunnel destination 172.28.1.5
 

Cisco IOS defines a tunnel interface incrementally, rather than the single command-line entry used by the CNA system. Specifically, here's what the Cisco commands did:

• The interface command identifies the tunnel to be created, named TunnelA
• The description command adds the text “Measurements to ISP A” to the tunnel configuration
• The ip address command identifies the tunnel IP address as 10.50.1.1 255.255.255.252; this address should be in the same network as the tunnel IP address specified on the CNA configuration-10.50.1.2 255.255.255.252
• The ip policy command identifies the route map to be used, named CNA-measurements (not yet created); the route map will ensure that traffic from a given USTAT will be directed to the correct ISP link
• The tunnel source command designates the address of the physical interface on the edge router-172.28.1.1 (Cisco IOS syntax requires you to specify it explicitly; CNA syntax has no such requirement-the address is implicitly set to the eth0 interface address of the USTAT module)
• The tunnel destination command should identify the physical address on the USTAT module

Repeat these commands for each GRE tunnel (one for each USTAT module/ISP pair).

The tunnel configuration in the previous section referred to a route map CNA-measurements, which does not yet exist, so you need to create it, along with an access list to restrict entry. Specify the USTAT module's VIP address in the access list:

ip access list 188 permit ip host 172.28.1.6 any
 
route-map CNA-measurements permit 90
 
 match ip address 188
 
 set interface Serial0/0 Null0
 

The name of the route map must match exactly the name used in the ip policy command when the GRE tunnel interface was created. This string is case sensitive.

The number 90 is a line number, which allows you to insert lines before or after this entry as you expand your policy rules.

The set interface command should point to the interface you use to access the ISP being monitored by this USTAT module.

The Null0 attribute black-holes all measurements over this link when this physical links is in a down state. This is important. If this is not present, the router may route the measurements normally and could create “false positive” measurements, which might in turn cause the CNA system to make undesirable decisions.

Repeat these commands for each of your USTAT module/ISP pairs, changing IP addresses and descriptions as necessary.