Generic routing and addressing - PBR, NAT, RIB-FIB
In one line
The addressing plan enables (or prevents) summarization, and PBR/NAT are deliberate exceptions to normal routing that carry real costs.
Policy-based routing (PBR)
Overrides destination-based forwarding by source, application, or markings. Use sparingly - it bypasses normal routing and TE, complicates troubleshooting, and can hide from convergence mechanisms. Justify it only for specific policy needs.
Three mechanics decide whether a PBR design is sound. First, liveness: PBR verifies only that the set next hop exists in the RIB - not that the path behind it is healthy - so a next hop that is up-but-dead (or reachable only on paper) silently blackholes the matched traffic; pair PBR with reachability tracking (IP SLA probe -> tracking object) or accept that failover never happens (Network management - traditional vs model-driven). Second, precedence: plain next-hop means policy first, routing as fallback (steer selected traffic off the routed path); default next-hop inverts it - routing first, policy only when the RIB has no route (an exit of last resort for otherwise-unroutable traffic). The two express opposite intents; picking the wrong one is a classic requirements miss. Third, visibility and direction: PBR never modifies the RIB, so the routing table does not show what conditional traffic actually does (a validation trap), and it applies per ingress interface, in one direction only - return traffic follows normal routing, so PBR manufactures asymmetry, which is a defect wherever stateful devices sit in the path (Perimeter security - firewalls and IPS-IDS). Router-originated traffic needs local PBR separately (e.g., steering management traffic).
NAT
Solves address conservation, overlap (mergers), and multihoming, but breaks end-to-end addressing: ALG requirements, asymmetry, logging/traceability, and broken referrals. In IPv6 the need largely disappears; use NAT64/NPTv6 only for transition/translation, not as a habit.
Addressing / subnetting
Hierarchical, structured addressing is the prerequisite for aggregation - if addresses aren't contiguous at boundaries, you can't summarize. Plan the address architecture before the routing design.
RIB-FIB relationship
The control plane builds the RIB (best routes); the data plane programs the FIB (CEF) for fast lookup, resolving recursion into a direct adjacency. This explains convergence (FIB update time) and why BGP PIC can fail over without re-running BGP.
Why it matters for design
A clean addressing plan makes summarization and convergence work; PBR and NAT are exceptions you should be able to justify and bound, not defaults.
IPv6 / dual-stack note
Plan v6 addressing for summarization; minimize NAT; use NAT64 only for transition. See IPv6 design and migration.
Related
- Route aggregation and summarization
- Fast convergence techniques
- Factors affecting convergence
- Network management - traditional vs model-driven - IP SLA + tracking makes PBR/static failover health-aware
Spaced repetition
Structured, hierarchical addressing matters most because it is the prerequisite for [...].
Structured, hierarchical addressing matters most because it is the prerequisite for route summarization / aggregation.
The control-plane table of best routes is the [...]; the data-plane forwarding table (CEF) is the [...].
The control-plane table of best routes is the RIB; the data-plane forwarding table (CEF) is the FIB.
PBR should be used sparingly because it [...].
PBR should be used sparingly because it bypasses normal destination-based routing/TE and complicates troubleshooting.
PBR next-hop vs default next-hop - what is the design difference?
next-hop = policy first, normal routing as fallback (steer selected traffic); default next-hop = routing first, policy applies only when no RIB route exists (exit of last resort). Opposite intents.
PBR verifies only that the next hop [...] - pair it with IP SLA + object tracking or an up-but-dead next hop blackholes matched traffic.
PBR verifies only that the next hop exists in the RIB, not that the path is healthy - pair it with IP SLA + object tracking or an up-but-dead next hop blackholes matched traffic.
Why does PBR threaten stateful designs?
It steers one direction only (per ingress interface) while return traffic follows normal routing - manufactured asymmetry that breaks firewalls/NAT in the path.
Sources
- Cisco Press, CCNP/CCIE ENCOR; Routing TCP/IP Vol II (NAT).
- Cisco Press, CCNP ENARSI 300-410 OCG (Edgeworth/Lacoste) - PBR behavior and conditional forwarding.