1

Is it possible to realize a kind of policy-based routing in cisco ios, which forwards 80port requests on external IP to internal hosts based on host header information (http address).

So if somebody accesses http://server1.com (external ip) it forwards request to internal_ip1 and if it is http://server2.com it forwards request to internal_ip2

I pretty well understand that this involves analizing HTTP data (application level), and it's possible to accomplish such scenario using ISA Server or Varnish proxy.

But is it possible to do such a trick on cisco?

3 Answers 3

0

So if somebody accesses http://server1.com (external ip) it forwards request to internal_ip1 and if it is http://server2.com it forwards request to internal_ip2

I pretty well understand that this involves analizing HTTP data (application level), and it's possible to accomplish such scenario using ISA Server or Varnish proxy.

But is it possible to do such a trick on cisco?

Yes, but you're going to have to remark DSCP bits in your interesting HTTP traffic. My solution below uses NBAR (Network-based Application Recognition) to remark DSCP bits on interesting traffic, with PBR (Policy-based routing) to route based on the aforementioned remarking.

Requirements:

  • The router must support nbar; typically this is CPU-based routers, such as a Cisco 1800/1900 Series. The Cisco ASR also supports NBAR
  • The router must support Policy-based Routing
  • You must not use DSCP AF12, or AF13 anywhere else in the network.

Config:

class-map match-all CLASSIFY_HTTP_01
 match protocol http host *server1.com*
class-map match-all CLASSIFY_HTTP_02
 match protocol http host *server2.com*
!
policy-map REMARK_HTTP
 class CLASSIFY_HTTP_01
  set dscp af12
 class CLASSIFY_HTTP_02
  set dscp af13
!
ip access-list extended AF12
 permit ip any any dscp af12
!
ip access-list extended AF13
 permit ip any any dscp af13
!
route-map PBR permit 10
 match ip address AF12
  ! This is a next-hop leading to internal_ip1
  set ip next-hop 192.0.2.129
 match ip address AF13
  ! This is a next-hop leading to internal_ip2
  set ip next-hop 192.0.2.130
!
interface FastEthernet0/1
 description [All HTTP ingress to this interface]
 ip address 192.0.2.2 255.255.255.252
 ip policy route-map PBR
 service-policy input REMARK_HTTP

All that said, many times you're much better-off using a real HTTP load-balancer such as an F5 for this kind of thing. You can force a router to do it, but it's a bit unnatural.

4
  • Thank you Mike! Definitely it requires NBAR and PBR. Agree its unnatural, but can be used just as PoC.
    – Ross
    Mar 10, 2014 at 15:50
  • Just now got my C892 router. Will be testing this in 1 day.
    – Ross
    Apr 11, 2014 at 15:11
  • Have got a problem with route-map statement. Looks like route-map can only have a 'match clauses' and 'set clauses', so you cannot have different match/set combinations within one route-map, or use different sequences. or maybe I enter it wrong?
    – Ross
    Apr 15, 2014 at 16:36
  • Give me details and we might be able to resolve the problem Apr 15, 2014 at 16:40
1

The solution only partly solves the problem, becuase I did not mention that we use NAT.

So, NBAR inspects all inbound packets through service-policy on outside interface, and assigns DSCP bits to them.

Now, the problem is to get these packets NAT-translated for internal ips. Schematically i need something like this:

nat inside source static tcp <internal_ip_1> 80 interface <outside_interface> 80 <if dscp bits = af13> 
nat inside source static tcp <internal_ip_2> 80 interface <outside_interface> 80 <if dscp bits = af12>
1

Futher to the original answer and to overcome the NAT issue, you should be able to assign the service-policy to the inside interface using the following line instead:

interface FastEthernet0/1 
 description Inside Interface
 ip address 192.0.2.2 255.255.255.252
 ip nat inside
 ip policy route-map PBR
 service-policy output REMARK_HTTP

I'm not in a position to test this at the moment, but since Network Address Translation has already been handled, I would imagine this should work fine.

Sorry to dig up an old post, but I'm interested in doing the same as the original poster, and thought I'd add this for the benefit of others.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .