Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm having difficulty to configure a route-map with multiple matches in AND operation. The issue is, both match criteria are against ACL, but different ACL.

What I want to do is

route-map TEST permit 10
  match ip address 100
  match ip address 110
  set vrf TESTVRF

I was expecting above to be AND operation for the match requirement.

However, when I issue show run, it becomes

route-map TEST permit 10
  match ip address 100 110
  set vrf TESTVRF

which is an OR operation by Cisco syntax.

The question is, how can I do multiple ACL match in AND operation for route-map? Thanks.

share|improve this question

2 Answers 2

If you can't have a single access-list you can just use route-map numbers to have an "OR" condition.

route-map TEST permit 10
  match ip address 100
  set vrf TESTVRF
route-map TEST permit 20
  match ip address 110
  set vrf TESTVRF
share|improve this answer
    
Hi HampusLi. I'm aware of OR syntax. But my PBR requirement needs AND –  zaidwaqi Feb 14 '12 at 0:50

Easiest way in my opinion is to setup an access-list with all the matches you need and put that in the route-map.

EDIT

Disclaimer: I'm just guessing here.

You can try this, assuming access-list 100 for sources and access-list 110 for destinations:

Here you revert the logic:

access-list 100 deny ip 10.0.0.0 255.255.255.0 any
access-list 100 permit any

access-list 110 deny ip any 192.168.0.0 255.255.255.0
access-list 110 permit any

and then

route-map TEST deny 10
   match ip address 100
route-map TEST deny 20
   match ip address 110
route-map TEST permit 30
   set vrf TESTVRF

The logic behind is:

if source_address is not 10.0.0.0/24 {
    fail
} else {
    if destination_address is not 192.168.0.0/24 {
        fail
    } else {
        set vrf TESTVRF
    }
}

Basically it checks first if source is permitted, if permitted then it checks if destination is permitted, so at last if BOTH are permitted set the vrf.

share|improve this answer
    
Issue is I need to match against 2 ACL's. First ACL to match source, second ACL to match destination. If I combine them in extended ACL that match both at the same time, it will be too long. –  zaidwaqi Feb 13 '12 at 15:18
    
@zaidwaqi If i understand that correctly, you need to match packets FROM a specific source TO a specific destination? As in access-list 100 permit ip 10.0.0.0 255.255.255.0 192.168.0.0 255.255.255.0? –  Mr Shunz Feb 13 '12 at 16:17
    
hi... that's correct. but I want to separate FROM and TO ACL. As in access-list 100 permit ip 10.0.0.0 255.255.255.0 any and access-list 110 permit ip any 192.168.0.0 255.255.255.0. Imagine I have 5 different IP to match for source, and 5 for destination. If I separate, the ACL length will only be 10 in total. If I combine, it will be 25 in length –  zaidwaqi Feb 14 '12 at 0:49
    
@zaidwaqi Edited the question for a possible solution –  Mr Shunz Feb 14 '12 at 12:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.