zNetLaB › Guided labs › Enterprise
Policy routing — one host out of the other door
Enterprise Advanced 6 devices 5 checked tasks 100 points Plan lab
Two links out, and the routing table prefers one of them for everybody. Send one host’s traffic out of the OTHER one without touching a single route — which is the only thing a routing table cannot do and policy routing can. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
Two links out, and the routing table prefers one of them for everybody. Send one host’s traffic out of the OTHER one without touching a single route — which is the only thing a routing table cannot do and policy routing can.
Your role: a network engineer on the enterprise team. Level: Advanced Done when: all 5 goals show as passed (100 points).
Network status
Devices: 3 routers, 1 switch, 2 PCs, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. R1 starts with addresses (G0/0 10.0.0.1/24, G0/1 198.51.100.2/30, G0/2 203.0.113.2/30) and static routes already configured. ISP-A starts with addresses (G0/0 198.51.100.1/30) and static routes already configured. ISP-B starts with addresses (G0/0 203.0.113.1/30) and static routes already configured. PC-Normal is a host with 10.0.0.10/24, gateway 10.0.0.1. PC-Policy is a host with 10.0.0.11/24, gateway 10.0.0.1. SW1 starts with an empty configuration. Known problems
The network worked and now does not: the scenario above says what users report. The cause is a configuration fault, not a cable. Find it with show commands (interfaces, routes, neighbours, running-config) before you change anything; fix only what is wrong. Goals
An access list matches only PC-Policy (20 pts) The default route still points at ISP-A (15 pts) PC-Policy reaches ISP-B’s address (30 pts) PC-Normal still reaches ISP-A’s address by the table (20 pts) Nothing was added to the routing table to do it (15 pts) The activity, in order
An access list matches only PC-Policy Why: Each goal is a state the lab can check on the running device. Verify with: show running-config The default route still points at ISP-A Why: The next hop must be an address on a directly connected subnet, or the route never enters the table. Verify with: show ip route PC-Policy reaches ISP-B’s address Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 203.0.113.1 PC-Normal still reaches ISP-A’s address by the table Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 198.51.100.1 Nothing was added to the routing table to do it Why: Each goal is a state the lab can check on the running device. Verify with: show running-config Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Why this matters
Two links out, and the routing table prefers one of them for everybody. Send one host’s traffic out of the OTHER one without touching a single route — which is the only thing a routing table cannot do and policy routing can.
What you will be able to do
An access list matches only PC-Policy
The default route still points at ISP-A
PC-Policy reaches ISP-B’s address
PC-Normal still reaches ISP-A’s address by the table
The network
ISR 2921, P Router, Catalyst 2960-24TT, PC — 6 devices in all, already cabled.
Gi0/0 10.0.0.1/24 Fa0/1 Gi0/1 198.51.100.2/30 Gi0/0 198.51.100.1/30 Gi0/2 203.0.113.2/30 Gi0/0 203.0.113.1/30 Fa0/10 Fa0 Fa0/11 Fa0 R1 ISP-A ISP-B SW1 PC-Normal 10.0.0.10/24 · gw 10.0.0.1 PC-Policy 10.0.0.11/24 · gw 10.0.0.1 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
R1 ISR 2921 configure it ISP-A P Router configure it ISP-B P Router configure it SW1 Catalyst 2960-24TT configure it PC-Normal PC 10.0.0.10 / 255.255.255.0 gw 10.0.0.1 PC-Policy PC 10.0.0.11 / 255.255.255.0 gw 10.0.0.1
Cabling
R1 Gi0/0 ↔ SW1 Fa0/1 R1 Gi0/1 ↔ ISP-A Gi0/0 R1 Gi0/2 ↔ ISP-B Gi0/0 SW1 Fa0/10 ↔ PC-Normal Fa0 SW1 Fa0/11 ↔ PC-Policy Fa0
What is configured at the start
These are already configured when the lab opens — including, where this is a troubleshooting lab, the fault itself:
R1 interface GigabitEthernet0/0
ip address 10.0.0.1 255.255.255.0
no shutdown
exit
interface GigabitEthernet0/1
ip address 198.51.100.2 255.255.255.252
no shutdown
exit
interface GigabitEthernet0/2
ip address 203.0.113.2 255.255.255.252
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 198.51.100.1 ISP-A interface GigabitEthernet0/0
ip address 198.51.100.1 255.255.255.252
no shutdown
exit
ip route 10.0.0.0 255.255.255.0 198.51.100.2 ISP-B interface GigabitEthernet0/0
ip address 203.0.113.1 255.255.255.252
no shutdown
exit
ip route 10.0.0.0 255.255.255.0 203.0.113.2 Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 An access list matches only PC-Policy 20 Checked automatically against the device’s live state (pbrOn). 2 The default route still points at ISP-A 15 On R1: show ip route 0.0.0.0 shows next hop 198.51.100.1. 3 PC-Policy reaches ISP-B’s address 30 On PC-Policy: ping 203.0.113.1 must succeed. 4 PC-Normal still reaches ISP-A’s address by the table 20 On PC-Normal: ping 198.51.100.1 must succeed. 5 Nothing was added to the routing table to do it 15 Checked automatically against the device’s live state (pbrOn). and On R1: show ip route 0.0.0.0 shows next hop 198.51.100.1.
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
R1 access-list 110 permit ip host 10.0.0.11 any
route-map VIA-B permit 10
match ip address 110
set ip next-hop 203.0.113.1
exit
route-map VIA-B permit 20
exit
interface GigabitEthernet0/0
ip policy route-map VIA-B
exit Where this is examined
This lab practises these topics in the zNetLaB certification courses:
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.