Configuring Localized Control Policy

Configuration Components

A route policy consists of a series of numbered (ordered) sequences of match-action pair that are evaluated in order, from lowest sequence number to highest sequence number. When a packet matches one of the match conditions, the associated action is taken and policy evaluation on that packets stops. Keep this in mind as you design your policies to ensure that the desired actions are taken on the items subject to policy.

If a packet matches no parameters in any of the sequences in the policy configured, it is, by default, rejected and discarded.

To create a localized data policy, you include the following components in the configuration on a vEdge router:

The following figure illustrates the configuration components for localized control policy.

General Configuration Procedure

Following are the high-level steps for configuring a route policy:

1. Create lists of prefixes, as needed:​
   vEdge(config)# policy lists
   vEdge(config-lists)# prefix-list list-nam
   vEdge(config-lists-list-name)# ip-prefix prefix/length
2. Create lists of BGP AS paths, and community and extended community attributes, as needed:
   vEdge(config)# policy lists
   vEdge(config-lists)# as-path-list list-name
   vEdge(config-lists-list-name)# as-path path-list
   vEdge(config)# policy lists
   vEdge(config-lists)# community-list list-name
   vEdge(config-lists-list-name)# community [aa:nn | internet | local-as | no-advertise | no-export]
   vEdge(config)# policy lists
   vEdge(config-lists)# ext-community-list list-name
   vEdge(config-lists-list-name)#community [rt (aa:nn | ip-address) | soo (aa:nn | ip-address)]

3. Create a route policy instance:
   vEdge(config)# policy route-policy policy-name
   vEdge(config-route-policy-policy-name)#
4. Create a series of match–action pair sequences:
   vEdge(config-route-policy-policy-name)# sequence number
   vEdge(config-sequence-number)#
   The match–action pairs are evaluated in order, by sequence number, starting with the lowest numbered pair and ending when the route matches the conditions in one of the pairs. Or if no match occurs, the default action is taken (either rejecting the route or accepting it as is).
5. Define match parameters for routes:
   vEdge(config-sequence-number)# match match-parameter
6. Define actions to take when a match occurs:
   vEdge(config-sequence-number)# action reject
   vEdge(config-sequence-number)# action accept set parameter
7. Create additional numbered sequences of match–action pairs within the router policy, as needed.
8. If a route does not match any of the conditions in one of the sequences, it is rejected by default. To accept nonmatching routes, configure the default action for the policy:
   vEdge(config-policy-name)# default-action accept
9. Apply the policy to a BGP address family, to all OSPF inbound routes, or when redistributing OSPF routes:
   vEdge(config)# vpn vpn-id router bgp local-as-number neighbor address
   vEdge(config-neighbor)# address-family ipv4-unicast
   vEdge(config-address-family-ipv4-unicast)# route-policy policy-name (in | out)
   
   vEdge(config)# vpn vpn-id router ospf
   vEdge(config-ospf)# route-policy policy-name in
   
   vEdge(config)# vpn vpn-id router ospf
   vEdge(config-ospf)# redistribute (bgp | connected | nat | omp | static) route-policy policy-name

Lists

Route policy uses the following types of lists to group related items. You configure lists under the policy lists command hierarchy on vEdge routers.

Sequences

A localized control policy contains sequences of match–action pairs. The sequences are numbered to set the order in which a route is analyzed by the match–action pairs in the policy. You configure sequences with the route-policy sequence command.

Each sequence in a localized control policy can contain one match command and one action

Match Parameters

For route policy routes, you can configure these parameters under the match command:

Action Parameters

When a route matches the conditions in the match portion of a route policy, the route can be accepted or rejected:

For a route that is accepted, the following actions can be configured:

Defining the Default Action

If a route being evaluated does not match any of the match conditions in a control policy, a default action is applied to this route. By default, the route is rejected. To modify this behavior, include the default-action accept command in the control policy.

Applying Route Policy for BGP

For a route policy to take effect for BGP, you must apply it to an address family. Currently, the Viptela software supports only the IPv4 address family, so you apply route policy with this command:

vEdge(config)# vpn vpn-id router bgp local-as-number neighbor​ address address-family ipv4-unicast route-policy policy-name (in | out)

Applying the policy in the inbound direction (in) affects routes being received by BGP. Applying the policy in the outbound direction (out) affects routes being advertised by BGP.

Applying Route Policy for OSPF

For a route policy to take effect for OSPF, you can apply it to all inbound traffic:

vEdge(config)# vpn vpn-id router ospf route-policy policy-name in

You can also apply the policy when redistributing routes into OSPF:

vEdge(config)# vpn vpn-id router ospf redistribute (bgp | connected | nat | omp | static) route-policy policy-name

Additional Information

Localized Control Policy