Policy Based Routing

You can control traffic forwarding in great detail using policy based routing (PBR). When you use PBR, you create routing tables of static routes (Action Tables), and direct traffic to the appropriate tables using Policy Rules.

Policy Rules

The Policy Rules specify what traffic is matched. You can route traffic by matching on one or more of the following:

• Security Gateway interface.
• Source IPv4 address and subnet mask.
• Destination IPv4 address and subnet mask.

The Policy Rules also specify the action to take if the traffic is matched:

• Prohibit: Send a Prohibit message to the sending host.
• Unreachable: Send an Unreachable message to the sending host.
• Table: Do the actions defined in an Action Table

You can define many Policy Rules. Traffic is matched to all the rules, one rule at a time, according to the priority that is configured for the rule.

Action Tables

The Action Tables define the static routes, that is, where the traffic is sent. You define the destination of the route and the next hop gateway to that destination.

Static Route Priorities

PBR static routes have priority over static routes in the routing table. When a packet arrives at the Gaia Security Gateway, the packet is checked for a match to a PBR static route. If it matches, the packet is forwarded according to the priority of the PBR static route. If the packet does not match a PBR static route, the packet is forwarded according to the priority of the static routes in the routing table.

Configuring Policy Based Routing - WebUI

The workflow for configuring Policy Bade Routing (PBR) is

1. In the Gaia WebUI, go to the Advanced Routing > Policy Based Routing page.
2. Configure one or more Action Tables. The Action Tables define the static routes, that is, where the traffic is sent. You define the destination of the route and the next hop gateway to that destination.
3. Configure Policy Rules. Define the traffic to match and the action to take if the traffic is matched. One of the possible Actions is to forward traffic to the static routes defined in an Action Table.

To Add an Action Table:

1. In the Action Tables section of the Policy Based Routing page, click Add.
2. In the Add Policy Table with Static Route window, define the Table Name.
3. Define the route to the destination. Choose one of:
   • Default Route.
   • Destination IPv4 address and Subnet mask.
4. Select the Next Hop Type. One of:
   • Normal
   • Blackhole
   • Reject
5. Add one or more Gateways to a normal destination. Click Add Gateway. You can select:
   • IP Address. Define the Gateway Priority.
   • Network interfaces. Define the Gateway Priority.
6. Click Save.

To Add a Policy Rule:

1. In the Policy Rules section of the Policy Based Routing page, click Add.
2. In the Add Policy Rule window, configure the Priority of the rule.
3. Configure the Action to take on the traffic that is matched. Choose one of:
   • Prohibit
   • Unreachable
   • Table. Select the Action Table.
4. Configure the traffic to match. Choose one or more of the following:
   • Interface
   • Source IPv4 address and subnet mask.
   • Destination IPv4 address and subnet mask.
5. Click Save.

To Delete a Policy Rule:

1. In the Policy Rules section of the Policy Based Routing page, select a rule.
2. Click Delete.

To Delete an Action Table:

1. In the Action Tables section of the Policy Based Routing page, select a static route table.
2. Click Delete.

Action Table Parameters

Policy Rule Parameters

Configuring Policy Based Routing - CLI

Create routing tables of static routes (Action Tables) and direct traffic to the appropriate tables by using Policy Rules.

To configure Action Tables:

table VALUE

static-route VALUE 

nexthop blackhole

nexthop reject

gateway address VALUE

gateway logical VALUE

<on | off>

To configure Policy Rules

priority VALUE

action prohibit

action unreachable

action table VALUE

from VALUE

to VALUE

interface VALUE

<on | off>

Monitoring Policy Based Routing

To monitor Policy Based Routing - WebUI

1. In the Gaia WebUI, go to the Advanced Routing > Policy Based Routing page.
2. Click the Monitoring tab.

To monitor Policy Based Routing - CLI

Run these commands:

show pbr tables

show pbr rules

show pbr summary