3

I'm having difficulty to configure a route-map with multiple matches in AND operation. The issue is, both match criteria are against ACL, but different ACL.

What I want to do is

route-map TEST permit 10
  match ip address 100
  match ip address 110
  set vrf TESTVRF

I was expecting above to be AND operation for the match requirement.

However, when I issue show run, it becomes

route-map TEST permit 10
  match ip address 100 110
  set vrf TESTVRF

which is an OR operation by Cisco syntax.

The question is, how can I do multiple ACL match in AND operation for route-map? Thanks.

3 Answers 3

2

Easiest way in my opinion is to setup an access-list with all the matches you need and put that in the route-map.

EDIT

Disclaimer: I'm just guessing here.

You can try this, assuming access-list 100 for sources and access-list 110 for destinations:

Here you revert the logic of the access-lists:

access-list 100 deny ip 10.0.0.0 255.255.255.0 any
access-list 100 permit any

access-list 110 deny ip any 192.168.0.0 255.255.255.0
access-list 110 permit any

and then use deny on your route-map (so if the access-list permits, then the rule fails):

route-map TEST deny 10
   match ip address 100
route-map TEST deny 20
   match ip address 110
route-map TEST permit 30
   set vrf TESTVRF

The logic behind this is:

if source_address is not 10.0.0.0/24 {
    fail
} else {
    if destination_address is not 192.168.0.0/24 {
        fail
    } else {
        set vrf TESTVRF
    }
}

Basically it checks first if source is permitted (via access-list 100), if permitted then it checks if destination is permitted (access-list 101), at last if BOTH are permitted set the vrf.

Then you can easily permit N different source networks in access-list 100 and M different destination networks in access-list 101.

4
  • Issue is I need to match against 2 ACL's. First ACL to match source, second ACL to match destination. If I combine them in extended ACL that match both at the same time, it will be too long.
    – zaidwaqi
    Feb 13, 2012 at 15:18
  • @zaidwaqi If i understand that correctly, you need to match packets FROM a specific source TO a specific destination? As in access-list 100 permit ip 10.0.0.0 255.255.255.0 192.168.0.0 255.255.255.0? Feb 13, 2012 at 16:17
  • hi... that's correct. but I want to separate FROM and TO ACL. As in access-list 100 permit ip 10.0.0.0 255.255.255.0 any and access-list 110 permit ip any 192.168.0.0 255.255.255.0. Imagine I have 5 different IP to match for source, and 5 for destination. If I separate, the ACL length will only be 10 in total. If I combine, it will be 25 in length
    – zaidwaqi
    Feb 14, 2012 at 0:49
  • @zaidwaqi Edited the question for a possible solution Feb 14, 2012 at 12:28
1

If you can't have a single access-list you can just use route-map numbers to have an "OR" condition.

route-map TEST permit 10
  match ip address 100
  set vrf TESTVRF
route-map TEST permit 20
  match ip address 110
  set vrf TESTVRF
1
  • Hi HampusLi. I'm aware of OR syntax. But my PBR requirement needs AND
    – zaidwaqi
    Feb 14, 2012 at 0:50
1

I am thinking you need to use object group instead. route-map alone, it seems it's not achievable.

it depends on device you have, and it might support and might not support. it may require ios upgrade or it may not support at all.

for example object-group network src 1.1.1.0/24

object-group network dst 2.2.2.0/24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .