Generic routing and addressing - PBR, NAT, RIB-FIB

Share

In one line

The addressing plan enables (or prevents) summarization, and PBR/NAT are deliberate exceptions to normal routing that carry real costs.

Policy-based routing (PBR)

Overrides destination-based forwarding by source, application, or markings. Use sparingly - it bypasses normal routing and TE, complicates troubleshooting, and can hide from convergence mechanisms. Justify it only for specific policy needs.

Three mechanics decide whether a PBR design is sound. First, liveness: PBR verifies only that the set next hop exists in the RIB - not that the path behind it is healthy - so a next hop that is up-but-dead (or reachable only on paper) silently blackholes the matched traffic; pair PBR with reachability tracking (IP SLA probe -> tracking object) or accept that failover never happens (Network management - traditional vs model-driven). Second, precedence: plain next-hop means policy first, routing as fallback (steer selected traffic off the routed path); default next-hop inverts it - routing first, policy only when the RIB has no route (an exit of last resort for otherwise-unroutable traffic). The two express opposite intents; picking the wrong one is a classic requirements miss. Third, visibility and direction: PBR never modifies the RIB, so the routing table does not show what conditional traffic actually does (a validation trap), and it applies per ingress interface, in one direction only - return traffic follows normal routing, so PBR manufactures asymmetry, which is a defect wherever stateful devices sit in the path (Perimeter security - firewalls and IPS-IDS). Router-originated traffic needs local PBR separately (e.g., steering management traffic).

NAT

Solves address conservation, overlap (mergers), and multihoming, but breaks end-to-end addressing: ALG requirements, asymmetry, logging/traceability, and broken referrals. In IPv6 the need largely disappears; use NAT64/NPTv6 only for transition/translation, not as a habit.

Addressing / subnetting

Hierarchical, structured addressing is the prerequisite for aggregation - if addresses aren't contiguous at boundaries, you can't summarize. Plan the address architecture before the routing design.

RIB-FIB relationship

The control plane builds the RIB (best routes); the data plane programs the FIB (CEF) for fast lookup, resolving recursion into a direct adjacency. This explains convergence (FIB update time) and why BGP PIC can fail over without re-running BGP.

Why it matters for design

A clean addressing plan makes summarization and convergence work; PBR and NAT are exceptions you should be able to justify and bound, not defaults.

IPv6 / dual-stack note

Plan v6 addressing for summarization; minimize NAT; use NAT64 only for transition. See IPv6 design and migration.

Spaced repetition

Structured, hierarchical addressing matters most because it is the prerequisite for [...].

Structured, hierarchical addressing matters most because it is the prerequisite for route summarization / aggregation.

The control-plane table of best routes is the [...]; the data-plane forwarding table (CEF) is the [...].

The control-plane table of best routes is the RIB; the data-plane forwarding table (CEF) is the FIB.

PBR should be used sparingly because it [...].

PBR should be used sparingly because it bypasses normal destination-based routing/TE and complicates troubleshooting.

PBR next-hop vs default next-hop - what is the design difference?

next-hop = policy first, normal routing as fallback (steer selected traffic); default next-hop = routing first, policy applies only when no RIB route exists (exit of last resort). Opposite intents.

PBR verifies only that the next hop [...] - pair it with IP SLA + object tracking or an up-but-dead next hop blackholes matched traffic.

PBR verifies only that the next hop exists in the RIB, not that the path is healthy - pair it with IP SLA + object tracking or an up-but-dead next hop blackholes matched traffic.

Why does PBR threaten stateful designs?

It steers one direction only (per ingress interface) while return traffic follows normal routing - manufactured asymmetry that breaks firewalls/NAT in the path.

Sources

  • Cisco Press, CCNP/CCIE ENCOR; Routing TCP/IP Vol II (NAT).
  • Cisco Press, CCNP ENARSI 300-410 OCG (Edgeworth/Lacoste) - PBR behavior and conditional forwarding.

domain: Core · blueprint-ref: Core 3.8 Generic routing and addressing concepts · type: concept · status: complete · tags: