Configure a routing policy

Required configuration items

The packet matching parameters. It can any combination of the following:

Source interface.
Source address. This can be a firewall zone, an interface, a single IPv4/IPv6 address or network, or a MAC address.
Destination address. This can be a firewall zone, an interface, a single IPv4/IPv6 address or network, or a domain.
Protocol. This can be any, tcp, udp or icmp.
Source port. This is only used if the protocol is set to tcp or udp.
Destination port. This is only used if protocol is set to tcp or udp.

The network interface used to reach the destination.

Additional configuration items

A label for the routing policy.
Whether packets that match this policy should be dropped when the gateway interface is disconnected, rather than forwarded through other interfaces.

To configure a routing policy:

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click Network > Routes > Policy-based routing.
Click the  to add a new route policy.
The new route policy page is displayed:
New route policies are enabled by default. To disable, toggle off Enable.
(Optional) For Label, type a label that will be used to identify this route policy.
For Interface, select the interface on the TX64 device that will be used with this route policy.
(Optional) Enable Exclusive to configure the policy to drop packets that match the policy when the gateway interface is disconnected, rather than forwarded through other interfaces.
For IP version, select Any, IPv4, or IPv6.
For Protocol, select Any, TCP, UDP, or ICMP.
- If TCP or UDP is selected for Protocol, type the port numbers of the Source port and Destination port, or set to any to match for any port.
- If ICMP is selected for Protocol, type the ICMP type and optional code, or set to any to match for any ICMP type.
For DSCP, type the 6-bit hexadecimal Differentiated Services Code Point (DSCP) field match criteria. This will match packets based on the DHCP field within the ToS field of the IP header.
Configure source address information:
1. Click to expand Source address.
2. For Type, select one of the following:
  - Zone: Matches the source IP address to the selected firewall zone. See Firewall configuration for more information about firewall zones.
  - Interface: Matches the source IP address to the selected interface's network address.
  - IPv4 address: Matches the source IP address to the specified IP address or network. Use the format IPv4_address[/netmask], or use any to match any IPv4 address.
  - IPv6 address: Matches the source IP address to the specified IP address or network. Use the format IPv6_address[/prefix_length], or use any to match any IPv6 address.
  - MAC address: Matches the source MAC address to the specified MAC address.
Configure the destination address information:
1. Click to expand Destination address.
2. For Type, select one of the following:
  - Zone: Matches the destination IP address to the selected firewall zone. See Firewall configuration for more information about firewall zones.
  - Interface: Matches the destination IP address to the selected interface's network address.
  - IPv4 address: Matches the destination IP address to the specified IP address or network. Use the format IPv4_address/[netmask], or use any to match any IPv4 address.
  - IPv6 address: Matches the destination IP address to the specified IP address or network. Use the format IPv6_address/[prefix_length], or use any to match any IPv6 address.
  - Domain: Matches the destination IP address to the specified domain names. To specify domains:
    1. Click to expand Domains.
    2. Click the  to add a domain.
    3. For Domain, type the domain name.
    4. Repeat to add additional domains.
  - Default route: Matches packets destined for the default route, excluding routes for local networks.
Click Apply to save the configuration and apply the change.

 Command line

Select the device in Remote Manager and click Actions > Open Console, or log into the TX64 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```

Add a new routing policy:

(config)> add network route policy end
(config network route policy 0)>

New route policies are enabled by default. To disable:

(config network route policy 0)> enable false
(config network route policy 0)>

(Optional) Set the label that will be used to identify this route policy:

(config network route policy 0)> label "New route policy"
(config network route policy 0)>

Set the interface on the TX64 device that will be used with this route policy:

Set the interface. For example:

(config network route policy 0)> interface /network/interface/wan1
(config network route policy 0)>

(Optional) Enable exclusive to configure the policy to drop packets that match the policy when the gateway interface is disconnected, rather than forwarded through other interfaces:
```
(config network route policy 0)> exclusive true
(config network route policy 0)> 
```

Select the IP version:

(config network route policy 0)> ip_version value
(config network route policy 0)>

where value is one of any, ipv4, or ipv6.

Set the protocol:
```
(config network route policy 0)> protocol value
(config network route policy 0)> 
```
where value is one of:
- any: All protocols are matched.
- tcp: Source and destination ports are matched:
  1. Set the source port:
```
(config network route policy 0)> src_port value
(config network route policy 0)> 
```
    where value is the port number, or the keyword any to match any port as the source port.
  2. Set the destination port:
```
(config network route policy 0)> dst_port value
(config network route policy 0)> 
```
    where value is the port number, or the keyword any to match any port as the destination port.
- upd: Source and destination ports are matched:
  1. Set the source port:
```
(config network route policy 0)> src_port value
(config network route policy 0)> 
```
    where value is the port number, or the keyword any to match any port as the source port.
  2. Set the destination port:
```
(config network route policy 0)> dst_port value
(config network route policy 0)> 
```
    where value is the port number, or the keyword any to match any port as the destination port.
- icmp: The ICMP protocol is matched. Identify the ICMP type:
```
(config network route policy 0)> icmp_type value
(config network route policy 0)> 
```
  where value is the ICMP type and optional code, or set to any to match for any ICMP type.

Set the source address type:

(config network route policy 0)> src type value
(config network route policy 0)>

where value is one of:

zone: Matches the source IP address to the selected firewall zone. Set the zone:

Set the zone. For example:

(config network route policy 0)> src zone external
(config network route policy 0)>

See Firewall configuration for more information about firewall zones.

interface: Matches the source IP address to the selected interface's network address. Set the interface:

Set the interface. For example:

(config network route policy 0)> src interface /network/interface/wan1
(config network route policy 0)>

address: Matches the source IPv4 address to the specified IP address or network. Set the address that will be matched:
```
(config network route policy 0)> src address value
(config network route policy 0)> 
```
where value uses the format IPv4_address[/netmask], or any to match any IPv4 address.
address6: Matches the source IPv6 address to the specified IP address or network. Set the address that will be matched:
```
(config network route policy 0)> src address6 value
(config network route policy 0)> 
```
where value uses the format IPv6_address[/prefix_length], or any to match any IPv6 address.
mac: Matches the source MAC address to the specified MAC address. Set the MAC address to be matched:
```
(config network route policy 0)> src mac MAC_address
(config network route policy 0)> 
```

Set the destination address type:

(config network route policy 0)> dst type value
(config network route policy 0)>

where value is one of:

zone: Matches the destination IP address to the selected firewall zone. Set the zone:

Set the zone. For example:

(config network route policy 0)> dst zone external
(config network route policy 0)>

See Firewall configuration for more information about firewall zones.

interface: Matches the destination IP address to the selected interface's network address. Set the interface:

Set the interface. For example:

(config network route policy 0)> dst interface /network/interface/wan1
(config network route policy 0)>

address: Matches the destination IPv4 address to the specified IP address or network. Set the address that will be matched:
```
(config network route policy 0)> dst address value
(config network route policy 0)> 
```
where value uses the format IPv4_address[/netmask], or any to match any IPv4 address.
address6: Matches the destination IPv6 address to the specified IP address or network. Set the address that will be matched:
```
(config network route policy 0)> dst address6 value
(config network route policy 0)> 
```
where value uses the format IPv6_address[/prefix_length], or any to match any IPv6 address.
mac: Matches the destination MAC address to the specified MAC address. Set the MAC address to be matched:
```
(config network route policy 0)> dst mac MAC_address
(config network route policy 0)> 
```

Save the configuration and apply the change.
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.