{"id":490980,"date":"2026-08-14T14:57:20","date_gmt":"2026-08-14T14:57:20","guid":{"rendered":"https:\/\/savepearlharbor.com\/?p=490980"},"modified":"-0001-11-30T00:00:00","modified_gmt":"2026-08-14T14:57:20","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=490980","title":{"rendered":"Policy Based Routing (Linux + Juniper)"},"content":{"rendered":"<div xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\">\n<p><strong>\u0414\u0430\u043d\u043e: <\/strong>\u0441\u0435\u0440\u0432\u0435\u0440 \u0441 Ubuntu \u0438 \u0434\u0432\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430 Juniper MX<\/p>\n<p><strong>\u0421\u0445\u0435\u043c\u0430 \u0441\u0442\u0435\u043d\u0434\u0430<\/strong><\/p>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/getpro\/habr\/upload_files\/f8c\/f98\/67a\/f8cf9867a2edaeb180694c924139bc64.png\" alt=\"\u0421\u0445\u0435\u043c\u0430 \u0441\u0442\u0435\u043d\u0434\u0430\" title=\"\u0421\u0445\u0435\u043c\u0430 \u0441\u0442\u0435\u043d\u0434\u0430\" width=\"1115\" height=\"800\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/getpro\/habr\/upload_files\/f8c\/f98\/67a\/f8cf9867a2edaeb180694c924139bc64.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/getpro\/habr\/upload_files\/f8c\/f98\/67a\/f8cf9867a2edaeb180694c924139bc64.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/p>\n<div><figcaption>\u0421\u0445\u0435\u043c\u0430 \u0441\u0442\u0435\u043d\u0434\u0430<\/figcaption><\/div>\n<\/figure>\n<p><strong>\u0417\u0430\u0434\u0430\u0447\u0430:<\/strong> \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c PBR (Policy Based Routing), \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 source ip \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 ISP (Internet Service Provider).<\/p>\n<h4>\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430<\/h4>\n<p><strong>\u041a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f netplan:<\/strong><\/p>\n<pre><code class=\"yaml\">network:\u00a0version: 2\u00a0renderer: networkd\u00a0ethernets:\u00a0\u00a0eth0:\u00a0\u00a0\u00a0dhcp4: no\u00a0\u00a0\u00a0addresses:\u00a0\u00a0\u00a0- 10.0.0.3\/24\u00a0\u00a0\u00a0routes:\u00a0\u00a0\u00a0- to: 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0via: 10.0.0.1 #router1\u00a0\u00a0\u00a0\u00a0table: 101\u00a0\u00a0\u00a0\u00a0on-link: True\u00a0\u00a0\u00a0- to: 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0via: 10.0.0.2 #router2\u00a0\u00a0\u00a0\u00a0table: 102\u00a0\u00a0\u00a0\u00a0on-link: True  lo:  \u00a0\u00a0\u00a0addresses:  \u00a0\u00a0\u00a0- 198.51.100.1\/32 # \u0414\u043b\u044f ISP1  \u00a0\u00a0\u00a0- 198.51.100.2\/32 # \u0414\u043b\u044f ISP2  \u00a0\u00a0\u00a0- 198.51.100.3\/32 # \u0414\u043b\u044f ISP3  \u00a0\u00a0\u00a0- 198.51.100.4\/32 # \u0414\u043b\u044f ISP4  \u00a0\u00a0\u00a0- 198.51.100.5\/32 # \u0414\u043b\u044f ISP5  \u00a0\u00a0\u00a0- 198.51.100.6\/32 # \u0414\u043b\u044f ISP6<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:87px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<p>\u041d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0434\u0432\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0438 \u0442.\u043a. \u0443 \u043d\u0430\u0441 \u0434\u0432\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u044d\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 <a href=\"https:\/\/linux.die.net\/man\/8\/ip\" rel=\"noopener noreferrer nofollow\">route table<\/a>:<\/p>\n<ol>\n<li>\n<p>\u041c\u0430\u0440\u0448\u0440\u0443\u0442 \u0432 \u0442\u0430\u0431\u043b\u0438\u0446\u0435 101 \u0447\u0435\u0440\u0435\u0437 10.0.0.1 (router1);<\/p>\n<\/li>\n<li>\n<p>\u041c\u0430\u0440\u0448\u0440\u0443\u0442 \u0432 \u0442\u0430\u0431\u043b\u0438\u0446\u0435 102 \u0447\u0435\u0440\u0435\u0437 10.0.0.2 (router2);<\/p>\n<\/li>\n<\/ol>\n<pre><code class=\"yaml\">server:~$ ip route show table 101default via 10.0.0.1 dev eth0 proto static onlinkserver:~$ ip route show table 102default via 10.0.0.2 dev eth0 proto static onlink<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<p>\u0421\u043e\u0437\u0434\u0430\u0435\u043c routing-policy, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0437\u0430\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 198.51.100.[1-3] \u0432 table 101, \u0442\u0440\u0430\u0444\u0438\u043a \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 198.51.100.[4-6] \u0432 table 102:<\/p>\n<pre><code class=\"yaml\">routing-policy:\u00a0\u00a0\u00a0- from: 198.51.100.1\/32\u00a0\u00a0\u00a0\u00a0table: 101\u00a0\u00a0\u00a0- from: 198.51.100.2\/32\u00a0\u00a0\u00a0\u00a0table: 101\u00a0\u00a0\u00a0- from: 198.51.100.3\/32\u00a0\u00a0\u00a0\u00a0table: 101\u00a0\u00a0\u00a0- from: 198.51.100.4\/32\u00a0\u00a0\u00a0\u00a0table: 102\u00a0\u00a0\u00a0- from: 198.51.100.5\/32\u00a0\u00a0\u00a0\u00a0table: 102\u00a0\u00a0\u00a0- from: 198.51.100.6\/32\u00a0\u00a0\u00a0\u00a0table: 102<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<h4>\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 Juniper MX<\/h4>\n<p>\u0421\u043e\u0437\u0434\u0430\u0435\u043c firewall filter \u0434\u043b\u044f PBR:<\/p>\n<pre><code>#ISP1set firewall filter PBR term ISP1 from source-address 198.51.100.1\/32set firewall filter PBR term ISP1 then next-ip 203.0.113.1#ISP2set firewall filter PBR term ISP2 from source-address 198.51.100.2\/32set firewall filter PBR term ISP2 then next-ip 203.0.113.2#ISP3set firewall filter PBR term ISP3 from source-address 198.51.100.3\/32set firewall filter PBR term ISP4 then next-ip 203.0.113.3#ISP4set firewall filter PBR term ISP4 from source-address 198.51.100.4\/32set firewall filter PBR term ISP5 then next-ip 203.0.113.4#ISP5set firewall filter PBR term ISP5 from source-address 198.51.100.5\/32set firewall filter PBR term ISP5 then next-ip 203.0.113.5#ISP6set firewall filter PBR term ISP6 from source-address 198.51.100.6\/32set firewall filter PBR term ISP6 then next-ip 203.0.113.6<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<p>\u0415\u0441\u043b\u0438 \u0432 \u0432\u0430\u0448\u0435\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 \u0441\u0442\u044b\u043a\u0438 \u0441 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c\u0438 \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u044b \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 routing-instance, \u0442\u043e \u0432 \u043a\u0430\u0436\u0434\u044b\u0439 term \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c:<\/p>\n<pre><code>set firewall filter PBR term &lt;ISPX&gt; then\u00a0next-ip routing-instance &lt;routing-instance name&gt;<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<p>\u041f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c firewall filter &#171;<em>PBR&#187;<\/em> \u043d\u0430 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b router1 \u0438 router2:<\/p>\n<pre><code>#router1set interfaces irb unit 200 family inet filter input PBRset interfaces irb unit 200 family inet address 10.0.0.1\/24#router2set interfaces irb unit 200 family inet filter input PBRset interfaces irb unit 200 family inet address 10.0.0.2\/24<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<p>\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e traceroute, \u043e\u043f\u0446\u0438\u044f -s \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u043a\u0430\u043a\u043e\u0439 IP \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 source.<\/p>\n<p>\u041d\u0430\u0441 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0443\u044e\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0435\u0440\u0432\u044b\u0435 \u0434\u0432\u0430 \u0445\u043e\u043f\u0430:<\/p>\n<pre><code>server# traceroute 8.8.8.8 -ns 198.51.100.1\u00a01\u00a010.0.0.1\u00a02\u00a0203.0.113.1 3 ***-----server# traceroute 8.8.8.8 -ns 198.51.100.2\u00a01\u00a010.0.0.1\u00a02\u00a0203.0.113.2 3 ***-----server# traceroute 8.8.8.8 -ns 198.51.100.3\u00a01\u00a010.0.0.1\u00a02\u00a0203.0.113.3 3 ***-----server# traceroute 8.8.8.8 -ns 198.51.100.4\u00a01\u00a010.0.0.2\u00a02\u00a0203.0.113.4 3 ***-----server# traceroute 8.8.8.8 -ns 198.51.100.5\u00a01\u00a010.0.0.2\u00a02\u00a0203.0.113.5 3 ***-----server# traceroute 8.8.8.8 -ns 198.51.100.6\u00a01\u00a010.0.0.2\u00a02\u00a0203.0.113.6 3 ***<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<p>\u0418\u0442\u043e\u0433\u043e, \u0442\u0440\u0430\u0444\u0438\u043a \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e ISP \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 src IP \u0441\u0435\u0440\u0432\u0435\u0440\u0430.<\/p>\n<h4>\u0412\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f:<\/h4>\n<ol>\n<li>\n<p>\u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0432 \u0441\u0435\u0442\u0438 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430;<\/p>\n<\/li>\n<li>\n<p> \u0421\u0431\u043e\u0440 \u0434\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (rtt, packet loss, etc) \u043f\u043e \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c;<\/p>\n<\/li>\n<li>\n<p>\u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0438\u043d\u0436\u0435\u043d\u0435\u0440, \u0443 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430(\u0438 \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c) \u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044e;<\/p>\n<\/li>\n<li>\n<p>\u0414\u0440\u0443\u0433\u0438\u0435 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u0442\u0440\u0430\u0431\u043b\u0448\u0443\u0442\u0438\u043d\u0433\u0430, \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435;<\/p>\n<\/li>\n<\/ol>\n<p>P.S. \u0421\u0442\u0430\u0442\u044c\u044f \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0430 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0441\u0442\u0432\u0438\u0438 \u0441 <a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc5737.html\" rel=\"noopener noreferrer nofollow\">RFC5737<\/a>, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 3 \u0431\u043b\u043e\u043a\u0430 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u0437\u0430\u0440\u0435\u0437\u0435\u0440\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f\u00a0\u043f\u0440\u0438\u043c\u0435\u0440\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u00a0\u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f\u0445 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0439 \u0438\u00a0\u0432\u00a0\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438<\/p>\n<p>\u041c\u043e\u0439 Telegram-\u043a\u0430\u043d\u0430\u043b: <a href=\"https:\/\/t.me\/life_of_network_engineer\" rel=\"noopener noreferrer nofollow\">https:\/\/t.me\/life_of_network_engineer<\/a><\/p>\n<\/div>\n<p>\u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 <a href=\"https:\/\/habr.com\/ru\/articles\/1070634\/\">https:\/\/habr.com\/ru\/articles\/1070634\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0414\u0430\u043d\u043e: \u0441\u0435\u0440\u0432\u0435\u0440 \u0441 Ubuntu \u0438 \u0434\u0432\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430 Juniper MX\u0421\u0445\u0435\u043c\u0430 \u0441\u0442\u0435\u043d\u0434\u0430\u0421\u0445\u0435\u043c\u0430 \u0441\u0442\u0435\u043d\u0434\u0430\u0417\u0430\u0434\u0430\u0447\u0430: \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c PBR (Policy Based Routing), \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 source ip \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 ISP (Internet Service Provider).\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u041a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f netplan:network:\u00a0version: 2\u00a0renderer: networkd\u00a0ethernets:\u00a0\u00a0eth0:\u00a0\u00a0\u00a0dhcp4: no\u00a0\u00a0\u00a0addresses:\u00a0\u00a0\u00a0&#8212; 10.0.0.3\/24\u00a0\u00a0\u00a0routes:\u00a0\u00a0\u00a0&#8212; to: 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0via: 10.0.0.1 #router1\u00a0\u00a0\u00a0\u00a0table: 101\u00a0\u00a0\u00a0\u00a0on-link: True\u00a0\u00a0\u00a0&#8212; to: 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0via: 10.0.0.2 #router2\u00a0\u00a0\u00a0\u00a0table: 102\u00a0\u00a0\u00a0\u00a0on-link: True  lo:  \u00a0\u00a0\u00a0addresses:  \u00a0\u00a0\u00a0&#8212; 198.51.100.1\/32 # \u0414\u043b\u044f ISP1  \u00a0\u00a0\u00a0&#8212; 198.51.100.2\/32 # \u0414\u043b\u044f ISP2  \u00a0\u00a0\u00a0&#8212; 198.51.100.3\/32 # \u0414\u043b\u044f ISP3  \u00a0\u00a0\u00a0&#8212; 198.51.100.4\/32 # \u0414\u043b\u044f ISP4  \u00a0\u00a0\u00a0&#8212; 198.51.100.5\/32 # \u0414\u043b\u044f ISP5  \u00a0\u00a0\u00a0&#8212; 198.51.100.6\/32 # \u0414\u043b\u044f ISP6\u041d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0434\u0432\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0438 \u0442.\u043a. \u0443 \u043d\u0430\u0441 \u0434\u0432\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u044d\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 route table:\u041c\u0430\u0440\u0448\u0440\u0443\u0442 \u0432 \u0442\u0430\u0431\u043b\u0438\u0446\u0435 101 \u0447\u0435\u0440\u0435\u0437 10.0.0.1 (router1);\u041c\u0430\u0440\u0448\u0440\u0443\u0442 \u0432 \u0442\u0430\u0431\u043b\u0438\u0446\u0435 102 \u0447\u0435\u0440\u0435\u0437 10.0.0.2 (router2);server:~$ ip route show table 101default via 10.0.0.1 dev eth0 proto static onlinkserver:~$ ip route show table 102default via 10.0.0.2 dev eth0 proto static onlink\u0421\u043e\u0437\u0434\u0430\u0435\u043c routing-policy, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u043c \u0437\u0430\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 198.51.100.[1-3] \u0432 table 101, \u0442\u0440\u0430\u0444\u0438\u043a \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 198.51.100.[4-6] \u0432 table 102:routing-policy:\u00a0\u00a0\u00a0&#8212; from: 198.51.100.1\/32\u00a0\u00a0\u00a0\u00a0table: 101\u00a0\u00a0\u00a0&#8212; from: 198.51.100.2\/32\u00a0\u00a0\u00a0\u00a0table: 101\u00a0\u00a0\u00a0&#8212; from: 198.51.100.3\/32\u00a0\u00a0\u00a0\u00a0table: 101\u00a0\u00a0\u00a0&#8212; from: 198.51.100.4\/32\u00a0\u00a0\u00a0\u00a0table: 102\u00a0\u00a0\u00a0&#8212; from: 198.51.100.5\/32\u00a0\u00a0\u00a0\u00a0table: 102\u00a0\u00a0\u00a0&#8212; from: 198.51.100.6\/32\u00a0\u00a0\u00a0\u00a0table: 102\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 Juniper MX\u0421\u043e\u0437\u0434\u0430\u0435\u043c firewall filter \u0434\u043b\u044f PBR:#ISP1set firewall filter PBR term ISP1 from source-address 198.51.100.1\/32set firewall filter PBR term ISP1 then next-ip 203.0.113.1#ISP2set firewall filter PBR term ISP2 from source-address 198.51.100.2\/32set firewall filter PBR term ISP2 then next-ip 203.0.113.2#ISP3set firewall filter PBR term ISP3 from source-address 198.51.100.3\/32set firewall filter PBR term ISP4 then next-ip 203.0.113.3#ISP4set firewall filter PBR term ISP4 from source-address 198.51.100.4\/32set firewall filter PBR term ISP5 then next-ip 203.0.113.4#ISP5set firewall filter PBR term ISP5 from source-address 198.51.100.5\/32set firewall filter PBR term ISP5 then next-ip 203.0.113.5#ISP6set firewall filter PBR term ISP6 from source-address 198.51.100.6\/32set firewall filter PBR term ISP6 then next-ip 203.0.113.6\u0415\u0441\u043b\u0438 \u0432 \u0432\u0430\u0448\u0435\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 \u0441\u0442\u044b\u043a\u0438 \u0441 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c\u0438 \u0432\u044b\u043d\u0435\u0441\u0435\u043d\u044b \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0439 routing-instance, \u0442\u043e \u0432 \u043a\u0430\u0436\u0434\u044b\u0439 term \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c:set firewall filter PBR term &lt;ISPX&gt; then\u00a0next-ip routing-instance &lt;routing-instance name&gt;\u041f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c firewall filter &#171;PBR&#187; \u043d\u0430 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b router1 \u0438 router2:#router1set interfaces irb unit 200 family inet filter input PBRset interfaces irb unit 200 family inet address 10.0.0.1\/24#router2set interfaces irb unit 200 family inet filter input PBRset interfaces irb unit 200 family inet address 10.0.0.2\/24\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e traceroute, \u043e\u043f\u0446\u0438\u044f -s \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u043a\u0430\u043a\u043e\u0439 IP \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 source.\u041d\u0430\u0441 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0443\u044e\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0435\u0440\u0432\u044b\u0435 \u0434\u0432\u0430 \u0445\u043e\u043f\u0430:server# traceroute 8.8.8.8 -ns 198.51.100.1\u00a01\u00a010.0.0.1\u00a02\u00a0203.0.113.1 3 ***&#8212;&#8212;server# traceroute 8.8.8.8 -ns 198.51.100.2\u00a01\u00a010.0.0.1\u00a02\u00a0203.0.113.2 3 ***&#8212;&#8212;server# traceroute 8.8.8.8 -ns 198.51.100.3\u00a01\u00a010.0.0.1\u00a02\u00a0203.0.113.3 3 ***&#8212;&#8212;server# traceroute 8.8.8.8 -ns 198.51.100.4\u00a01\u00a010.0.0.2\u00a02\u00a0203.0.113.4 3 ***&#8212;&#8212;server# traceroute 8.8.8.8 -ns 198.51.100.5\u00a01\u00a010.0.0.2\u00a02\u00a0203.0.113.5 3 ***&#8212;&#8212;server# traceroute 8.8.8.8 -ns 198.51.100.6\u00a01\u00a010.0.0.2\u00a02\u00a0203.0.113.6 3 ***\u0418\u0442\u043e\u0433\u043e, \u0442\u0440\u0430\u0444\u0438\u043a \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e ISP \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 src IP \u0441\u0435\u0440\u0432\u0435\u0440\u0430.\u0412\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f:\u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0432 \u0441\u0435\u0442\u0438 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430; \u0421\u0431\u043e\u0440 \u0434\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (rtt, packet loss, etc) \u043f\u043e \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c;\u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0438\u043d\u0436\u0435\u043d\u0435\u0440, \u0443 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430(\u0438 \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c) \u043a \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044e;\u0414\u0440\u0443\u0433\u0438\u0435 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b \u0442\u0440\u0430\u0431\u043b\u0448\u0443\u0442\u0438\u043d\u0433\u0430, \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435;P.S. \u0421\u0442\u0430\u0442\u044c\u044f \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0430 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0441\u0442\u0432\u0438\u0438 \u0441 RFC5737, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 3 \u0431\u043b\u043e\u043a\u0430 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u0437\u0430\u0440\u0435\u0437\u0435\u0440\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f\u00a0\u043f\u0440\u0438\u043c\u0435\u0440\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u00a0\u043e\u043f\u0438\u0441\u0430\u043d\u0438\u044f\u0445 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0439 \u0438\u00a0\u0432\u00a0\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438\u041c\u043e\u0439 Telegram-\u043a\u0430\u043d\u0430\u043b: https:\/\/t.me\/life_of_network_engineer\u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 https:\/\/habr.com\/ru\/articles\/1070634\/<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-490980","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/490980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=490980"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/490980\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=490980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=490980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=490980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}