Route Map

Route maps provide a powerful and flexible mechanism for controlling route redistribution, filtering, and attribute manipulation in NX-OS routing policies through ordered sequences of match and set clauses. Each route map entry defines permit or deny actions with match criteria based on prefix lists, AS paths, community values, interfaces, metrics, tags, and route types, combined with set actions for modifying attributes like next-hop, local preference, metric, community, and weight. Route maps are essential for implementing complex routing policies across BGP, OSPF, IS-IS, and static route redistribution scenarios.

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
route_maps	List	route_maps	No

route_maps (nxos.devices.configuration)

Name	Type	Constraint	Mandatory
name	String		Yes
pbr_statistics	Boolean	`true`, `false`	No
entries	List	entries	No

entries (nxos.devices.configuration.route_maps)

Name	Type	Constraint	Mandatory
order	Integer	min: `0`, max: `65535`	Yes
action	Choice	`permit`, `deny`	No
description	String		No
drop_on_fail_v4	Boolean	`true`, `false`	No
drop_on_fail_v6	Boolean	`true`, `false`	No
force_order_v4	Boolean	`true`, `false`	No
force_order_v6	Boolean	`true`, `false`	No
load_share_v4	Boolean	`true`, `false`	No
load_share_v6	Boolean	`true`, `false`	No
set_default_next_hop_v4	Boolean	`true`, `false`	No
set_default_next_hop_v6	Boolean	`true`, `false`	No
set_vrf_v4	Boolean	`true`, `false`	No
set_vrf_v6	Boolean	`true`, `false`	No
verify_availability_v4	Boolean	`true`, `false`	No
verify_availability_v6	Boolean	`true`, `false`	No
match_ip_address_prefix_list	String		No
match_ipv6_address_prefix_list	String		No
match_ip_address	String		No
match_ipv6_address	String		No
match_ip_next_hop_prefix_list	String		No
match_as_path	List	String	No
match_as_number_as_path_list	List	String	No
match_community	String		No
match_community_exact_match	Boolean	`true`, `false`	No
match_extcommunities	List	String	No
match_extcommunity_exact_match	Boolean	`true`, `false`	No
match_large_communities	List	String	No
match_large_community_exact_match	Boolean	`true`, `false`	No
match_tags	List	Integer[min: `0`, max: `4294967295`]	No
match_interfaces	List	match_interfaces	No
match_route_types	List	Choice[`internal`, `external`, `local`, `type-1`, `type-2`, `nssa-external`, `level-1`, `level-2`, `inter-area`, `intra-area`, `redistributed-direct`]	No
match_evpn_route_types	List	Choice[`1`, `2`, `2-mac-only`, `2-mac-ip`, `3`, `4`, `5`, `6`]	No
set_community	String		No
set_community_additive	Boolean	`true`, `false`	No
set_community_none	Boolean	`true`, `false`	No
set_comm_list	String		No
set_extcommunity_rt	List	String	No
set_extcommunity_rt_additive	Boolean	`true`, `false`	No
set_extcommunity_4byteas_generic_transitives	List	String	No
set_extcommunity_4byteas_generic_non_transitives	List	String	No
set_extcommunity_4byteas_generic_additive	Boolean	`true`, `false`	No
set_extcommunity_4byteas_generic_none	Boolean	`true`, `false`	No
set_extcommunity_costs	List	set_extcommunity_costs	No
set_extcommunity_color	Integer	min: `1`, max: `4294967295`	No
set_extcommunity_color_co_flag	Choice	`00`, `01`	No
set_extcommunity_bandwidth	Integer	min: `1`, max: `4000000`	No
set_extcommunity_evpn_rmac	MAC		No
set_extcomm_list	String		No
set_large_communities	List	String	No
set_large_community_additive	Boolean	`true`, `false`	No
set_large_community_none	Boolean	`true`, `false`	No
set_large_community_list	String		No
set_as_path_prepend	List	Any[String or Integer[min: `1`, max: `4294967295`]]	No
set_as_path_prepend_last_as	Integer	min: `1`, max: `10`	No
set_origin	Choice	`egp`, `igp`, `incomplete`	No
set_origin_egp_asn	Any	String or Integer[min: `1`, max: `4294967295`]	No
set_tag	Integer	min: `0`, max: `4294967295`	No
set_weight	Integer	min: `0`, max: `65535`	No
set_pctag	Integer	min: `1`, max: `65535`	No
set_local_preference	Integer	min: `0`, max: `4294967295`	No
set_metric	String		No
set_metric_delay	Integer	min: `0`, max: `4294967295`	No
set_metric_load	Integer	min: `0`, max: `255`	No
set_metric_mtu	Integer	min: `0`, max: `16777215`	No
set_metric_reliability	Integer	min: `0`, max: `255`	No
set_metric_type	Choice	`type-1`, `type-2`, `internal`, `external`	No
set_path_selection_advertise	Choice	`unspecified`, `all`, `backup`, `best2`, `multipaths`	No
set_evpn_gateway_ip	IP		No
set_evpn_gateway_ip_type	Choice	`ip-address`, `nexthop`	No
set_ip_next_hop_peer_address	Boolean	`true`, `false`	No
set_ip_next_hop_unchanged	Boolean	`true`, `false`	No
set_ip_next_hop_redist_unchanged	Boolean	`true`, `false`	No
set_ipv6_next_hop_peer_address	Boolean	`true`, `false`	No
set_ipv6_next_hop_unchanged	Boolean	`true`, `false`	No
set_ipv6_next_hop_redist_unchanged	Boolean	`true`, `false`	No
set_ip_next_hops	List	set_ip_next_hops	No
set_ipv6_next_hops	List	set_ipv6_next_hops	No
set_interface_null0	Boolean	`true`, `false`	No
set_vrf	String		No

entries (nxos.devices.configuration.route_maps)

Name	Type	Constraint	Mandatory
order	Integer	min: `0`, max: `65535`	Yes
action	Choice	`permit`, `deny`	No
description	String		No
drop_on_fail_v4	Boolean	`true`, `false`	No
drop_on_fail_v6	Boolean	`true`, `false`	No
force_order_v4	Boolean	`true`, `false`	No
force_order_v6	Boolean	`true`, `false`	No
load_share_v4	Boolean	`true`, `false`	No
load_share_v6	Boolean	`true`, `false`	No
set_default_next_hop_v4	Boolean	`true`, `false`	No
set_default_next_hop_v6	Boolean	`true`, `false`	No
set_vrf_v4	Boolean	`true`, `false`	No
set_vrf_v6	Boolean	`true`, `false`	No
verify_availability_v4	Boolean	`true`, `false`	No
verify_availability_v6	Boolean	`true`, `false`	No
match_ip_address_prefix_list	String		No
match_ipv6_address_prefix_list	String		No
match_ip_address_access_list	String		No
match_ip_next_hop_prefix_list	String		No
match_community	String		No
match_community_exact_match	Boolean	`true`, `false`	No
match_tags	List	Integer[min: `0`, max: `4294967295`]	No
set_community	String		No
set_community_additive	Boolean	`true`, `false`	No
set_community_none	Boolean	`true`, `false`	No
set_local_preference	Integer	min: `0`, max: `4294967295`	No
set_metric	String		No
set_metric_delay	Integer	min: `0`, max: `4294967295`	No
set_metric_load	Integer	min: `0`, max: `255`	No
set_metric_mtu	Integer	min: `0`, max: `16777215`	No
set_metric_reliability	Integer	min: `0`, max: `255`	No
set_metric_type	Choice	`type-1`, `type-2`, `internal`, `external`	No
set_path_selection_advertise	Choice	`unspecified`, `all`, `backup`, `best2`, `multipaths`	No
set_evpn_gateway_ip	IP		No
set_evpn_gateway_ip_type	Choice	`ip-address`, `nexthop`	No
set_ip_next_hop_peer_address	Boolean	`true`, `false`	No
set_ip_next_hop_unchanged	Boolean	`true`, `false`	No
set_ip_next_hop_redist_unchanged	Boolean	`true`, `false`	No
set_ipv6_next_hop_peer_address	Boolean	`true`, `false`	No
set_ipv6_next_hop_unchanged	Boolean	`true`, `false`	No
set_ipv6_next_hop_redist_unchanged	Boolean	`true`, `false`	No

match_interfaces (nxos.devices.configuration.route_maps.entries)

Name	Type	Constraint	Mandatory	Default Value
interface_type	Choice	`ethernet`, `loopback`, `mgmt`, `port-channel`, `vlan`, `vni`	Yes
interface_id	Any	String or Integer[min: `0`]	Yes

set_extcommunity_costs (nxos.devices.configuration.route_maps.entries)

Name	Type	Constraint	Mandatory
community_id	Integer	min: `0`, max: `255`	Yes
cost	Integer	min: `0`, max: `4294967295`	Yes
pre_bestpath	Boolean	`true`, `false`	No

set_ip_next_hops (nxos.devices.configuration.route_maps.entries)

Name	Type	Constraint	Mandatory
address	IP		Yes
track	Integer	min: `1`, max: `512`	No
vrf	String		No

set_ipv6_next_hops (nxos.devices.configuration.route_maps.entries)

Name	Type	Constraint	Mandatory
address	IP		Yes
track	Integer	min: `1`, max: `512`	No
vrf	String		No

Examples

Example 1: Simple route map to tag loopback routes redistributed into BGP with a community value

nxos:
  devices:
    - name: SPINE1
      configuration:
        route_maps:
          - name: RM-LOOPBACKS-OUT
            entries:
              - order: 10
                action: permit
                description: "Match loopback prefixes and set community"
                match_ip_address_prefix_list: PL-LOOPBACKS
                set_community: "65000:100"

Example 2: Route map with multiple entries for BGP peer policy — permit specific prefixes with different community treatments

nxos:
  devices:
    - name: LEAF1
      configuration:
        route_maps:
          - name: RM-TENANT-EXPORT
            entries:
              - order: 10
                action: permit
                description: "Tag tenant subnet routes with community"
                match_ip_address_prefix_list: PL-TENANT-NETS
                set_community: "65000:1010"
              - order: 20
                action: permit
                description: "Allow default route with additive community"
                match_ip_address_prefix_list: PL-DEFAULT-ONLY
                set_community: "65000:9999"
                set_community_additive: true
              - order: 30
                action: deny
                description: "Deny all other prefixes"

Example 3: Multiple route maps on a border leaf for inbound/outbound BGP filtering, tag-based matching, and PBR statistics

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        route_maps:
          # Inbound policy from external BGP peer
          - name: RM-EXTERNAL-IN
            entries:
              - order: 10
                action: permit
                description: "Accept external routes and tag with community"
                match_ip_address_prefix_list: PL-EXTERNAL-PREFIXES
                set_community: "65000:500"
              - order: 20
                action: deny
                description: "Implicit deny all other inbound routes"
          # Outbound policy to external BGP peer
          - name: RM-EXTERNAL-OUT
            entries:
              - order: 10
                action: permit
                description: "Advertise loopbacks to external peer"
                match_ip_address_prefix_list: PL-LOOPBACKS
                set_community: "65000:100"
                set_community_additive: true
              - order: 20
                action: permit
                description: "Advertise tenant subnets with tag 1000"
                match_tags:
                  - 1000
                set_community: "65000:200"
              - order: 30
                action: deny
                description: "Block everything else outbound"
          # PBR route map for traffic steering
          - name: RM-PBR-STEERING
            pbr_statistics: true
            entries:
              - order: 10
                action: permit
                description: "Steer matched traffic to firewall"
                match_ip_address_prefix_list: PL-FIREWALL-REDIRECT
                set_default_next_hop_v4: true

Example 4: Route map setting metric for OSPF redistribution into BGP

nxos:
  devices:
    - name: BORDER-LEAF2
      configuration:
        route_maps:
          - name: RM-OSPF-TO-BGP
            entries:
              - order: 10
                action: permit
                description: "Redistribute OSPF routes with modified metric"
                match_ip_address_prefix_list: PL-OSPF-ROUTES
                set_metric: "200"
              - order: 20
                action: permit
                description: "Set EIGRP-style composite metric"
                match_ip_address_prefix_list: PL-EIGRP-ROUTES
                set_metric: "100000"
                set_metric_delay: 100
                set_metric_reliability: 255
                set_metric_load: 1
                set_metric_mtu: 1500

Example 5: Route map setting metric type for OSPF external route redistribution

nxos:
  devices:
    - name: BORDER-LEAF3
      configuration:
        route_maps:
          - name: RM-BGP-TO-OSPF
            entries:
              - order: 10
                action: permit
                description: "Redistribute as OSPF type-1 external"
                match_ip_address_prefix_list: PL-BGP-ROUTES
                set_metric: "50"
                set_metric_type: type-1
              - order: 20
                action: permit
                description: "Redistribute remaining as type-2 external"
                set_metric_type: type-2

Example 6: Route map with BGP next-hop manipulation for route reflector and redistribution scenarios

nxos:
  devices:
    - name: RR1
      configuration:
        route_maps:
          - name: RM-RR-NEXTHOP
            entries:
              - order: 10
                action: permit
                description: "Set next-hop to peer address for reflected routes"
                match_ip_address_prefix_list: PL-TENANT-ROUTES
                set_ip_next_hop_peer_address: true
                set_ipv6_next_hop_peer_address: true
              - order: 20
                action: permit
                description: "Preserve next-hop unchanged for eBGP routes"
                match_ip_address_prefix_list: PL-EXTERNAL-ROUTES
                set_ip_next_hop_unchanged: true
                set_ipv6_next_hop_unchanged: true
          - name: RM-REDIST-NEXTHOP
            entries:
              - order: 10
                action: permit
                description: "Keep original next-hop for redistributed routes"
                set_ip_next_hop_redist_unchanged: true
                set_ipv6_next_hop_redist_unchanged: true

Example 7: Route map matching both IPv4 and IPv6 prefix lists for dual-stack BGP filtering

nxos:
  devices:
    - name: BORDER-LEAF4
      configuration:
        route_maps:
          - name: RM-DUAL-STACK-IN
            entries:
              - order: 10
                action: permit
                description: "Match allowed IPv4 prefixes"
                match_ip_address_prefix_list: PL-ALLOWED-V4
                set_community: "65000:400"
              - order: 20
                action: permit
                description: "Match allowed IPv6 prefixes"
                match_ipv6_address_prefix_list: PLV6-ALLOWED-V6
                set_community: "65000:600"
              - order: 30
                action: deny
                description: "Deny all other prefixes"

Example 8: Route map with set local-preference and match community for BGP path selection

nxos:
  devices:
    - name: LEAF1
      configuration:
        route_maps:
          - name: RM-BGP-LOCAL-PREF
            entries:
              - order: 10
                action: permit
                description: "Prefer routes matching community list"
                match_community: CL-PREFERRED
                match_community_exact_match: true
                set_local_preference: 200
              - order: 20
                action: permit
                description: "Default local preference for all other routes"
                set_local_preference: 100

Example 9: Route map with match ip address (access list) and match ip next-hop prefix-list

nxos:
  devices:
    - name: BORDER1
      configuration:
        route_maps:
          - name: RM-FILTER-NEXTHOP
            entries:
              - order: 10
                action: permit
                description: "Match routes by access-list and next-hop"
                match_ip_address: ACL-ROUTES
                match_ip_next_hop_prefix_list: PL-VALID-NEXTHOPS
                set_local_preference: 150
              - order: 20
                action: deny

Example 10: Route map with EVPN gateway-ip and path-selection advertise for EVPN type-5 routes

nxos:
  devices:
    - name: BORDER-GW1
      configuration:
        route_maps:
          - name: RM-EVPN-GW
            entries:
              - order: 10
                action: permit
                description: "Set EVPN gateway IP for type-5 routes"
                match_ip_address_prefix_list: PL-EVPN-SUBNETS
                set_evpn_gateway_ip: "10.255.0.1"
                set_evpn_gateway_ip_type: ip-address
              - order: 20
                action: permit
                description: "Advertise all BGP paths"
                set_path_selection_advertise: all

Example 11: Route map matching AS-path access lists to filter routes by AS-path

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        ip_as_path_access_lists:
          - name: ASPATH-DENY-65110
            entries:
              - seq: 10
                action: permit
                regex: "_65110_"
          - name: ASPATH-LOCAL
            entries:
              - seq: 10
                action: permit
                regex: "^$"
        route_maps:
          - name: RM-BGP-IN
            entries:
              - order: 10
                action: deny
                description: "Drop routes transiting AS 65110"
                match_as_path:
                  - ASPATH-DENY-65110
              - order: 20
                action: permit
                description: "Accept locally originated routes"
                match_as_number_as_path_list:
                  - ASPATH-LOCAL

Example 12: Route map with AS-path prepend, weight, pctag, origin, extended community route targets and route-type matching

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        ip_community_lists:
          - name: CL-STRIP
            entries:
              - seq: 10
                action: permit
                communities:
                  - "65000:999"
        route_maps:
          - name: RM-EXTERNAL-OUT
            entries:
              - order: 10
                action: permit
                description: "Prepend own AS and strip internal communities on loopbacks"
                match_interfaces:
                  - interface_type: loopback
                    interface_id: 0
                set_as_path_prepend:
                  - 65000
                  - 65000
                set_comm_list: CL-STRIP
                set_origin: igp
              - order: 20
                action: permit
                description: "Tag OSPF internal routes and attach route targets"
                match_route_types:
                  - internal
                  - inter-area
                set_tag: 1000
                set_weight: 200
                set_pctag: 100
                set_extcommunity_rt:
                  - "65000:100"
                  - "65000:200"
                set_extcommunity_rt_additive: true
          - name: RM-EVPN-IN
            entries:
              - order: 10
                action: permit
                description: "Accept EVPN MAC-IP and IP prefix routes, repeat last AS"
                match_evpn_route_types:
                  - 2-mac-ip
                  - 5
                set_as_path_prepend_last_as: 2
              - order: 20
                action: permit
                description: "Mark redistributed connected routes as EGP origin"
                match_route_types:
                  - redistributed-direct
                set_origin: egp
                set_origin_egp_asn: 65001

Example 13: Route map matching extcommunity and large community lists and setting extended and large communities

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        ip_extcommunity_lists:
          - name: ECL-TENANT-A
            mode: standard
            entries:
              - seq: 10
                action: permit
                rts:
                  - "65000:10010"
        ip_large_community_lists:
          - name: LCL-TENANT-A
            entries:
              - seq: 10
                action: permit
                communities:
                  - "4200000001:1:100"
        route_maps:
          - name: RM-DCI-OUT
            entries:
              - order: 10
                action: permit
                description: "Rewrite tenant A routes for the DCI"
                match_extcommunities:
                  - ECL-TENANT-A
                match_extcommunity_exact_match: true
                set_extcomm_list: ECL-TENANT-A
                set_extcommunity_4byteas_generic_transitives:
                  - "4200000001:100"
                set_extcommunity_4byteas_generic_additive: true
                set_extcommunity_costs:
                  - community_id: 10
                    cost: 100
                    pre_bestpath: true
                set_extcommunity_color: 200
                set_extcommunity_color_co_flag: "01"
                set_extcommunity_bandwidth: 1000
                set_extcommunity_evpn_rmac: "00:11:22:33:44:55"
              - order: 20
                action: permit
                description: "Replace tenant A large communities"
                match_large_communities:
                  - LCL-TENANT-A
                set_large_community_list: LCL-TENANT-A
                set_large_communities:
                  - "4200000001:2:100"
                set_large_community_additive: true
              - order: 30
                action: permit
                description: "Strip all extended and large communities"
                set_extcommunity_4byteas_generic_none: true
                set_large_community_none: true

Example 14: Policy-based routing with tracked next-hops, VRF next-hops, a Null0 drop entry, a VRF redirect and IPv4/IPv6 policies applied to an SVI

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        feature:
          pbr: true
          interface_vlan: true
        route_maps:
          - name: RM-PBR-V4
            entries:
              - order: 10
                action: permit
                description: "Steer web traffic to tracked firewall next-hops"
                match_ip_address: ACL-WEB
                verify_availability_v4: true
                set_ip_next_hops:
                  - address: 10.10.10.1
                    track: 10
                  - address: 10.10.10.2
                    track: 11
              - order: 20
                action: permit
                description: "Resolve backup traffic next-hop in VRF BACKUP"
                match_ip_address: ACL-BACKUP
                set_vrf_v4: true
                set_ip_next_hops:
                  - address: 10.20.20.1
                    vrf: BACKUP
              - order: 30
                action: permit
                description: "Drop blocked traffic"
                match_ip_address: ACL-BLOCKED
                set_interface_null0: true
              - order: 40
                action: permit
                description: "Redirect guest traffic into VRF GUEST"
                match_ip_address: ACL-GUEST
                set_vrf: GUEST
          - name: RM-PBR-V6
            entries:
              - order: 10
                action: permit
                description: "Steer IPv6 web traffic to firewall"
                match_ipv6_address: ACL6-WEB
                set_ipv6_next_hops:
                  - address: 2001:db8:10::1
        interfaces:
          vlans:
            - id: 100
              ip:
                address: 10.100.0.1/24
                policy_route_map: RM-PBR-V4
              ipv6:
                addresses:
                  - address: 2001:db8:100::1/64
                policy_route_map: RM-PBR-V6