Routing Policies

Routing Policies Overview

Contrail uses routing policies to control the flow of network traffic between virtual networks (VNs). Routing policies enable you to define how traffic is forwarded, filtered, and controlled based on certain conditions. Routing policies define conditions (source or destination IP address, packet attributes, routing protocols) packets must meet for the policy to apply.

For more information about routing policies, see Routing Policy.

Routing Policy List Terms

Routing policies contain a set of list terms. List terms are conditions and actions that determine how routing policies handle traffic. Each routing policy can consist of one or more terms. Each terms specifies a set of conditions (match conditions) to be met and the corresponding actions to take if those conditions are fulfilled. A term can be a terminal rule, meaning that upon a match on the specified term, no further terms are evaluated and the route is dropped or accepted, based on the action in that term.

If the term is not a terminal rule, subsequent terms are evaluated for the given route. The following example shows the structure of list terms:

Policy {
     Term-1
     Term-2
}

The following example shows the structure of a term's match conditions and actions:

from {
    match-condition-1
    match-condition-2
    ..
    ..
}
then {
    action
    update-action-1
    update-action-2
    ..
    ..
}

A term cannot contain an any match condition. For example, an empty from cannot be present.

If an any match condition is present, all routes are considered as matching the term. In contrast, the then condition can be empty or the action can be unspecified.

Apply a Routing Policy

A routing policy evaluation has the following key points:

• If the term of a routing policy consists of multiple match conditions, a route must satisfy all match conditions to apply the action specified in the term.

• If a term in the policy does not specify a match condition, all routes are evaluated against the match.

• If a match occurs but the policy does not specify an accept, reject, or next term action, one of the following occurs:

  • The next term, if present, is evaluated.

  • If no other terms are present, the next policy is evaluated.

  • If no other policies are present, the route is accepted. The default routing policy action is “accept”.

• If a match does not occur with a term in a policy, and subsequent terms in the same policy exist, the next term is evaluated.

• If a match does not occur with any terms in a policy, and subsequent policies exist, the next policy is evaluated.

• If a match does not occur by the end of a policy or all policies, the route is accepted.

A routing policy consists of multiple terms. Each term consists of match conditions and actions to apply to matching routes.

Each route is evaluated against the policy as follows:

1. The route is evaluated against the first term. If it matches, the specified action is taken. If the action is to accept or reject the route, that action is taken and the evaluation of the route ends. If the next term action is specified or if no action is specified, or if the route does not match, the evaluation continues as described above to subsequent terms.

2. Upon hitting the last non-terminal term of the given routing policy, the route is evaluated against the next policy, if present, in the same manner as described in step 1.

Create a Routing Policy

The following is an exampe virtual network with a routing policy referenced in the routingPolicyReferences field.

apiVersion: core.contrail.juniper.net/v5 
kind: VirtualNetwork 
metadata: 
  creationTimestamp: "2023-08-24T16:52:41Z" 
  finalizers: 
  - virtual-network-id-deallocation.finalizers.core.juniper.net 
  - route-target.finalizers.core.juniper.net 
  - vn-routinginstance-delete.finalizers.core.juniper.net 
  generation: 4 
  labels: 
    back-reference.core.juniper.net/4b55d55948465b8794a75b29ea02b2d4b7cb6f0130c52ae127815c9e: Subnet_rptest-ns_rptest-subnet-1 
    back-reference.core.juniper.net/626783989131f732c144823b1b51ea67fd949c537f8c775e25e530d5: RoutingPolicy_rptest-ns_rptest 
    back-reference.core.juniper.net/dd5f04a405320d130c348a4e6d02cabef25d0633cc1ff4813a3576f9: RoutingPolicy_rptest-ns_rptestCommunityReject 
    core.juniper.net/virtualnetwork: custom-default-podnetwork 
    custom-default-podnetwork-uid: 4761b2bc-7ae0-4c33-8b51-894b665e3ebd 
  name: rptest-vn-1 
  namespace: rptest-ns 
  resourceVersion: "6342" 
  uid: 4761b2bc-7ae0-4c33-8b51-894b665e3ebd 
spec: 
  fabricSNAT: true 
  fqName: 
  - default-domain 
  - rptest-ns 
  - rptest-vn-1 
  podNetwork: true 
  routingPolicyReferences: 
  - apiVersion: core.contrail.juniper.net/v5 
    fqName: 
    - default-domain 
    - rptest-ns 
    - rptest 
    kind: RoutingPolicy 
    name: rptest 
    namespace: rptest-ns 
    uid: 8a142d00-f7fb-4872-85b6-11d6a576d7fe 
  - apiVersion: core.contrail.juniper.net/v5 
    fqName: 
    - default-domain 
    - rptest-ns 
    - rptestCommunityExample 
    kind: RoutingPolicy 
    name: rptestCommunityExample 
    namespace: rptest-ns 
    uid: 7a142d00-f7fb-4872-85b6-11d6a576d7fe 
  v4SubnetReference: 
    apiVersion: core.contrail.juniper.net/v5 
    fqName: 
    - default-domain 
    - rptest-ns 
    - rptest-subnet-1 
    kind: Subnet 
    name: rptest-subnet-1 
    namespace: rptest-ns 
    uid: 4dd9c840-4e72-4125-97a2-f9eb5bfb756a 
  virtualNetworkProperties: 
    forwardingMode: l2_l3 
    rpf: enable 
status: 
  observation: "" 
  state: Success 
  virtualNetworkNetworkId: 4100 

Routing Policies and BGP Extended Communities

Border Gateway Protocol (BGP) extended communities are additional attributes for BGP routes. BGP extended communities provide a method of associating additional information like route target or encapsulation protocol with routes. Creating a routing policy with extended communities makes the policy more granular, enabling you to distribute routes and manage traffic effectively. This makes BGP extended communities ideal for complex, dynamic routes.

CN2 offers extended community support with the import routing policy feature. This feature allows for the use of import routing policy terms to identify extended communities and execute import routing policy actions, such as the addition, adjustment, or removal of these extended communities.

CN2 supports the following extended communities:

• Route Target

• Encapsulation

• Security Group

• Origin VN

• MAC Mobility

• Load Balance

• Tag

• Color

For information about these extended communities, see BGP Extended Communities.

Create a Routing Policy With BGP Extended Communities

The following is an example of a routing policy that matches with a BGP extended community. The following example matches for a prefix specified in the termMatchCondition field and attaches the BGP color community (color:0:100) when the prefix is matched.

apiVersion: core.contrail.juniper.net/v5
kind: RoutingPolicy
metadata:
  namespace: color-ns
  name: color-rp-3
spec:
  routingPolicyEntries:
    term:
      - termActionList:
          update:
            asPath:
              expand: {}
            community:
              add: {}
              remove: {}
              set: {}
            extcommunity:
              add:
                community:
                  - color:0:100
              remove: {}
              set: {}
            service:
              add: {}
              remove: {}
              set: {}
        termMatchCondition:
          asPath:
          community:
          communityList:
          communityMatchAll:
          extcommunityList:
          extcommunityMatchAll:
          external:
          family:
          localPref:
          nlriRouteType:
          prefix:
            - prefix: 172.100.70.5/32
              prefixType: exact
          prefixList:

Note the following fields:

• term: Represents a defined condition and associated actions to execute if term conditons are met.

• extcommunity: add:: Specifies an extended community to add to the route.

  community: Contains the extended community string color:0:100.

• termMatchCondition: Specifies the conditions that must be satisfied for the actions in the term to take effect.

• asPath, community, localPref: Specifies additional term match conditions to match with the route.

• prefix: A match condition that specifies that the term will match with routes with the exact prefix 172.100.70.5/32.

The following table provides addition information about the fields of a routing policy.

Policy Actions