ePBR

Enhanced Policy-Based Redirect (ePBR) steers traffic through service appliances such as firewalls, load balancers and IPS devices without changing the routing table. Services group one or more service end-points with health probes, service chains link services in order, and ePBR policies match traffic with access lists and redirect it to services. Policies are applied to Layer-3 interfaces (SVIs, Ethernet and port-channel interfaces and subinterfaces) in forward and reverse direction, or to Layer-2 interfaces with an egress interface, using the epbr sub-section of each interface.

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No
interface_groups	List	interface_groups	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

interface_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
interfaces	Class	interfaces	No
epbr	Class	epbr	No

configuration (nxos.interface_groups)

Name	Type	Constraint	Mandatory	Default Value
subinterfaces	List	subinterfaces	No
epbr	Class	epbr	No

interfaces (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
ethernets	List	ethernets	No
port_channels	List	port_channels	No
vlans	List	vlans	No

ethernets (nxos.devices.configuration.interfaces)

Name	Type	Constraint	Mandatory	Default Value
subinterfaces	List	subinterfaces	No
epbr	Class	epbr	No

port_channels (nxos.devices.configuration.interfaces)

Name	Type	Constraint	Mandatory	Default Value
subinterfaces	List	subinterfaces	No
epbr	Class	epbr	No

vlans (nxos.devices.configuration.interfaces)

Name	Type	Constraint	Mandatory	Default Value
epbr	Class	epbr	No

subinterfaces (nxos.devices.configuration.interfaces.ethernets)

Name	Type	Constraint	Mandatory	Default Value
epbr	Class	epbr	No

epbr (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
infra_vlans	Class	infra_vlans	No
services	List	services	No
service_chains	List	service_chains	No
failover_groups	List	failover_groups	No
policies	List	policies	No

epbr (nxos.devices.configuration.interfaces.ethernets)

Name	Type	Constraint	Mandatory	Default Value
ip_policy	String		No
ip_policy_reverse	String		No
ipv6_policy	String		No
ipv6_policy_reverse	String		No
l2_policy	String		No
l2_policy_egress_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
l2_policy_egress_interface_id	Any	String or Integer[min: 0]	No
l2_policy_reverse	String		No
l2_policy_reverse_egress_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
l2_policy_reverse_egress_interface_id	Any	String or Integer[min: 0]	No

infra_vlans (nxos.devices.configuration.epbr)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

services (nxos.devices.configuration.epbr)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
type	Choice	l3, l2, l3-redirect	No
vrf	String		No
service_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
service_interface_id	Any	String or Integer[min: 0]	No
shutdown	Boolean	true, false	No
mode	Choice	full-duplex, half-duplex	No
security_group	Integer	min: 0, max: 65535	No
security_group_reverse	Integer	min: 0, max: 65535	No
hold_down_threshold_count	Integer	min: 0, max: 10	No
hold_down_threshold_time	Integer	min: 0, max: 86400	No
threshold	Integer	min: 0, max: 100	No
probe	Class	probe	No
service_end_points	List	service_end_points	No
service_end_point_interfaces	List	service_end_point_interfaces	No

service_chains (nxos.devices.configuration.epbr)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
load_balance_method	Choice	src-ip, dst-ip, src-dst-ipprotocol	No
mode_multisite	Boolean	true, false	No
mode_multisite_failover_group	String		No
sequences	List	sequences	No

failover_groups (nxos.devices.configuration.epbr)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
service_chains	List	service_chains	No

policies (nxos.devices.configuration.epbr)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
statistics	Boolean	true, false	No
source_vrf	String		No
destination_vrf	String		No
default_traffic_action	Choice	redirect, redirect-all	No
matches	List	matches	No

ranges (nxos.devices.configuration.epbr.infra_vlans)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: 1, max: 4094	Yes
to	Integer	min: 1, max: 4094	Yes

probe (nxos.devices.configuration.epbr.services)

Name	Type	Constraint	Mandatory	Default Value
protocol	Choice	icmp, tcp, udp, http, dns, ctp	No
port	Integer	min: 0, max: 65535	No
http_get	String		No
http_version	Choice	1.0, 1.1	No
dns_host	String		No
control	Boolean	true, false	No
frequency	Integer	min: 0, max: 604800	No
retry_down_count	Integer	min: 0, max: 5	No
retry_up_count	Integer	min: 0, max: 5	No
timeout	Integer	min: 0, max: 604800	No
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
reverse_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
reverse_interface_id	Any	String or Integer[min: 0]	No

service_end_points (nxos.devices.configuration.epbr.services)

Name	Type	Constraint	Mandatory	Default Value
ip	IP		Yes
interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
interface_id	Any	String or Integer[min: 0]	No
shutdown	Boolean	true, false	No
hold_down_threshold_count	Integer	min: 0, max: 10	No
hold_down_threshold_time	Integer	min: 0, max: 86400	No
mode	Choice	primary, hot-standby	No
weight	Integer	min: 1, max: 10	No
probe	Class	probe	No
reverse	Class	reverse	No

service_end_point_interfaces (nxos.devices.configuration.epbr.services)

Name	Type	Constraint	Mandatory	Default Value
interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	Yes
interface_id	Any	String or Integer[min: 0]	Yes
probe	Class	probe	No
reverse	Class	reverse	No

sequences (nxos.devices.configuration.epbr.service_chains)

Name	Type	Constraint	Mandatory	Default Value
sequence_number	Integer	min: 1, max: 65535	Yes
set_service	String		Yes
fail_action	Choice	bypass, forward, drop	No
load_balance_method	Choice	src-ip, dst-ip, src-dst-ipprotocol	No
action	Choice	redirect, route	No
reverse_action	Choice	redirect, route	No

service_chains (nxos.devices.configuration.epbr.failover_groups)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
preference	Integer	min: 0, max: 255	No

matches (nxos.devices.configuration.epbr.policies)

Name	Type	Constraint	Mandatory	Default Value
type	Choice	ip, ipv6, l2	Yes
address	String		Yes
source_vrf	String		No
destination_vrf	String		No
drop	Boolean	true, false	No
exclude	Boolean	true, false	No
vlans	Class	vlans	No
load_balance_buckets	Integer	min: 0, max: 256	No
load_balance_method	Choice	src-ip, dst-ip, src-dst-ipprotocol	No
load_balance_mask_position	Integer	min: 0, max: 127	No
sequences	List	sequences	No

probe (nxos.devices.configuration.epbr.services.service_end_points)

Name	Type	Constraint	Mandatory	Default Value
protocol	Choice	icmp, tcp, udp, http, dns, ctp	No
port	Integer	min: 0, max: 65535	No
http_get	String		No
http_version	Choice	1.0, 1.1	No
dns_host	String		No
control	Boolean	true, false	No
frequency	Integer	min: 0, max: 604800	No
retry_down_count	Integer	min: 0, max: 5	No
retry_up_count	Integer	min: 0, max: 5	No
timeout	Integer	min: 0, max: 604800	No
source_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
source_interface_id	Any	String or Integer[min: 0]	No
reverse_interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
reverse_interface_id	Any	String or Integer[min: 0]	No
track	Integer	min: 1, max: 512	No

reverse (nxos.devices.configuration.epbr.services.service_end_points)

Name	Type	Constraint	Mandatory	Default Value
ip	IP		No
interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
interface_id	Any	String or Integer[min: 0]	No
probe	Class	probe	No

reverse (nxos.devices.configuration.epbr.services.service_end_point_interfaces)

Name	Type	Constraint	Mandatory	Default Value
interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	No
interface_id	Any	String or Integer[min: 0]	No
probe	Class	probe	No

vlans (nxos.devices.configuration.epbr.policies.matches)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

sequences (nxos.devices.configuration.epbr.policies.matches)

Name	Type	Constraint	Mandatory	Default Value
sequence_number	Integer	min: 1, max: 65535	Yes
set_service	String		Yes
fail_action	Choice	bypass, forward, drop	No

Examples

Example 1: Firewall service with two end-points, ICMP probing and a policy applied to an SVI

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        feature:
          epbr: true
          interface_vlan: true
        vrfs:
          - name: TENANT1
        vlan:
          vlans:
            - id: 100
        ip_access_lists:
          - name: ACL-WEB
            entries:
              - sequence_number: 10
                action: permit
                protocol: tcp
                source:
                  prefix: 10.10.0.0
                  prefix_length: 16
                destination:
                  prefix: any
                  port_operator: eq
                  port_1: 443
        epbr:
          services:
            - name: FIREWALL
              vrf: TENANT1
              probe:
                protocol: icmp
                frequency: 5
                retry_down_count: 2
                retry_up_count: 2
                timeout: 3
              service_end_points:
                - ip: 10.100.0.11
                  reverse:
                    ip: 10.200.0.11
                - ip: 10.100.0.12
                  mode: hot-standby
                  reverse:
                    ip: 10.200.0.12
          policies:
            - name: POL-WEB
              statistics: true
              matches:
                - type: ip
                  address: ACL-WEB
                  sequences:
                    - sequence_number: 10
                      set_service: FIREWALL
                      fail_action: bypass
        interfaces:
          vlans:
            - id: 100
              vrf: TENANT1
              epbr:
                ip_policy: POL-WEB
                ip_policy_reverse: POL-WEB

Example 2: Service chain through a firewall and an IPS with per-end-point probes, load balancing and a multisite failover group

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        feature:
          epbr: true
        tracks:
          - id: 10
            interface_type: loopback
            interface_id: 10
            interface_line_protocol: true
        epbr:
          infra_vlans:
            ids: [3900]
          services:
            - name: FIREWALL
              service_interface_type: vlan
              service_interface_id: 3901
              security_group: 100
              security_group_reverse: 200
              probe:
                protocol: tcp
                port: 80
                control: true
                frequency: 5
                source_interface_type: loopback
                source_interface_id: 10
                reverse_interface_type: loopback
                reverse_interface_id: 10
              service_end_points:
                - ip: 10.100.0.11
                  weight: 3
                  probe:
                    protocol: http
                    http_get: index.html
                    http_version: "1.1"
                    frequency: 60
                    timeout: 30
                  reverse:
                    ip: 10.200.0.11
                    probe:
                      track: 10
            - name: IPS
              probe:
                protocol: udp
                port: 53
              service_end_points:
                - ip: 10.110.0.11
                  interface_type: ethernet
                  interface_id: 1/10
                  probe:
                    protocol: dns
                    dns_host: www.example.com
          service_chains:
            - name: CHAIN-FW-IPS
              load_balance_method: src-ip
              mode_multisite: true
              mode_multisite_failover_group: FG-DC2
              sequences:
                - sequence_number: 10
                  set_service: FIREWALL
                  load_balance_method: dst-ip
                - sequence_number: 20
                  set_service: IPS
                  action: route
                  reverse_action: route
            - name: CHAIN-DC2
              mode_multisite: true
              sequences:
                - sequence_number: 10
                  set_service: FIREWALL
          failover_groups:
            - name: FG-DC2
              service_chains:
                - name: CHAIN-DC2
                  preference: 10

Example 3: IPv4 and IPv6 policies with VRF redirection, load-balance buckets, drop and exclude matches on a routed port

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        feature:
          epbr: true
        epbr:
          services:
            - name: LB
              probe:
                protocol: icmp
              service_end_points:
                - ip: 10.120.0.11
            - name: LB-V6
              probe:
                protocol: icmp
              service_end_points:
                - ip: 2001:db8:120::11
          policies:
            - name: POL-APP
              source_vrf: default
              destination_vrf: default
              matches:
                - type: ip
                  address: ACL-APP
                  source_vrf: default
                  destination_vrf: default
                  load_balance_buckets: 8
                  load_balance_method: src-ip
                  load_balance_mask_position: 2
                  sequences:
                    - sequence_number: 10
                      set_service: LB
                      fail_action: drop
                - type: ip
                  address: ACL-BLOCKED
                  drop: true
                - type: ip
                  address: ACL-MGMT
                  exclude: true
            - name: POL-APP-V6
              matches:
                - type: ipv6
                  address: ACL6-APP
                  sequences:
                    - sequence_number: 10
                      set_service: LB-V6
                      fail_action: bypass
        interfaces:
          ethernets:
            - id: 1/11
              switchport:
                enabled: false
              epbr:
                ip_policy: POL-APP
                ipv6_policy: POL-APP-V6

Example 4: Layer-2 service with interface end-points and a Layer-2 policy applied to a trunk with an egress interface

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          epbr: true
        epbr:
          services:
            - name: L2-FIREWALL
              type: l2
              mode: half-duplex
              service_end_point_interfaces:
                - interface_type: ethernet
                  interface_id: 1/12
                  probe:
                    protocol: ctp
                    frequency: 10
                  reverse:
                    interface_type: ethernet
                    interface_id: 1/13
                    probe:
                      protocol: ctp
          policies:
            - name: POL-L2
              default_traffic_action: redirect-all
              matches:
                - type: l2
                  address: MAC-ACL-ALL
                  vlans:
                    ids: [200]
                  sequences:
                    - sequence_number: 10
                      set_service: L2-FIREWALL
        interfaces:
          ethernets:
            - id: 1/20
              switchport:
                mode: trunk
              epbr:
                l2_policy: POL-L2
                l2_policy_egress_interface_type: ethernet
                l2_policy_egress_interface_id: 1/21