Hi, do you use any L3 priorization for your VoIP phone traffic?
If so, you can use the ToS field/value to separate the voice traffic within 10.x.x.x via access list with ToS match from the other traffic. Just as a hint. Cheers, Markus ___________________________ On 12.06.2012, at 22:16, Odilo Schwade Junior <[email protected]> wrote: Hi all, We are testing some PBR on our Matrix N7 Platinum with FW: 07.41.03.0009 and we are a little bit confuse about precedence and stuff.. Here is some example: *Access-List:* ! ip access-list extended 101 permit ip 10.0.0.0 0.255.255.255 X.X.X.X 0.0.15.255 { OUR ROUTED IPs } exit ip access-list extended 102 permit ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255 exit ip access-list extended 103 permit ip 10.0.0.0 0.255.255.255 any exit ip access-list extended 104 permit ip any 10.100.252.0 0.0.1.255 { VPN } exit *Our Route Map for testing *: route-map policy 113 permit 96 match ip address 103 set next-hop { OUR NAT IP} route-map policy 113 permit 97 match ip address 102 route-map policy 113 permit 98 match ip address 101 route-map policy 113 permit 99 match ip address 104 set next-hop {OUR VPN IP} Policy matches: 1836 packets *Our Old Route Map*: route-map policy 110 permit 5 match ip address 104 set next-hop { OUR VPN IP } route-map policy 110 permit 10 match ip address 101 route-map policy 110 permit 20 match ip address 102 … … {LOTS OF same stuff..} … route-map policy 110 permit 99 match ip address 103 set next-hop { OUR NAT IP } Policy matches: 1736276030 packets We tested invert the precedence to see the behavior of precedence matches. Our real problem is ANY internal IP is accessing ANYthing through our NAT, for instance, ours VOIP Phones (10.x.x.x) when calling another VOIP Phone (10.x.x.x) we are able, using TCPDUMP on our NAT (Linux machine), to see that connection between them are passing through NAT.. that’s so wrong right?! Anyways, all of our network now is passing through our NAT.. this may be the cause of some slow connections, VOIP problems, etc., this is old configuration (something like 7 years, imported to router to router) that we discovered just now. Any ideas our miss match configuration that we were not able to see that you can help us??! Any other information needed please just tell me.. -- *Odilo Schwade Junior* GTI - Gerência de Tecnologia da Informação Universidade do Vale do Itajaí – UNIVALI ( +55 (47) 3341 – 7777 * [email protected] * [email protected] P *ANTES DE IMPRIMIR*, tenha em mente seu compromisso com o *MEIO AMBIENTE*! ** - --To unsubscribe from enterasys, send email to [email protected] with the body: unsubscribe enterasys [email protected] --- To unsubscribe from enterasys, send email to [email protected] with the body: unsubscribe enterasys [email protected]
