path control 2...

r4#trace 192.168.1.1 source 192.168.4.1
Type escape sequence to abort.
Tracing the route to 192.168.1.1
VRF info: (vrf in name/id, vrf out name/id)
  1 172.16.34.3 16 msec 32 msec 4 msec
  2 172.16.23.2 12 msec 28 msec 12 msec
  3 172.16.12.1 12 msec 40 msec *

you built it, you must know why?

r3#sh ip eigrp topo 192.168.1.0
EIGRP-IPv4 Topology Entry for AS(1)/ID(192.168.3.1) for 192.168.1.0/24
  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 21152000
  Descriptor Blocks:
  172.16.23.2 (Serial1/2), from 172.16.23.2, Send flag is 0x0
      Composite metric is (21152000/20640000), route is Internal
      Vector metric:
        Minimum bandwidth is 128 Kbit
        Total delay is 45000 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 2
        Originating router is 192.168.1.1
  172.16.13.1 (Serial1/1), from 172.16.13.1, Send flag is 0x0
      Composite metric is (40640000/128256), route is Internal
      Vector metric:
        Minimum bandwidth is 64 Kbit
        Total delay is 25000 microseconds
        Reliability is 255/255
        Load is 1/255
        Minimum MTU is 1500
        Hop count is 1
        Originating router is 192.168.1.1
r3#

it's twice as fast the long way... but you saw that coming...

so make a damn pbr to use r3-->r1 instead...

access-list 1 permit 192.168.4.128 0.0.0.127

route-map r3r1 permit
match ip add 1
set ip next-hop 172.16.13.1

put it all up in the interface

int s1/3
ip policy route-map r3r1

you could get fancy and make a named access-list...

r3#sh route-map
route-map r3r1, permit, sequence 10
  Match clauses:
    ip address (access-lists): 1
  Set clauses:
    ip next-hop 172.16.13.1
  Policy routing matches: 0 packets, 0 bytes

r4#trace 192.168.1.1 source 192.168.4.1
Type escape sequence to abort.
Tracing the route to 192.168.1.1
VRF info: (vrf in name/id, vrf out name/id)
  1 172.16.34.3 20 msec 8 msec 4 msec
  2 172.16.23.2 12 msec 20 msec 16 msec
  3 172.16.12.1 20 msec 36 msec *

this trace doesn't work... why? because our acl is for 4.128 and above...

r4#trace 192.168.1.1 source 192.168.4.129
Type escape sequence to abort.
Tracing the route to 192.168.1.1
VRF info: (vrf in name/id, vrf out name/id)
  1 172.16.34.3 16 msec 32 msec 8 msec
  2 172.16.13.1 8 msec 8 msec * 

this one does because we are specifying the source correctly... so adjust the acl...

access-list 1 permit 192.168.4.0 0.0.0.127

r4#trace 192.168.1.1 source 192.168.4.1 
Type escape sequence to abort.
Tracing the route to 192.168.1.1
VRF info: (vrf in name/id, vrf out name/id)
  1 172.16.34.3 36 msec 4 msec 4 msec
  2 172.16.13.1 8 msec 8 msec *

r3#sh route-map
route-map r3r1, permit, sequence 10
  Match clauses:
    ip address (access-lists): 1
  Set clauses:
    ip next-hop 172.16.13.1
  Policy routing matches: 12 packets, 384 bytes

now we have some matches...

r4#ping ip 192.168.1.1 source 192.168.4.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.4.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/8/12 ms

that works too...

r3#sh route-map
route-map r3r1, permit, sequence 10
  Match clauses:
    ip address (access-lists): 1
  Set clauses:
    ip next-hop 172.16.13.1
  Policy routing matches: 17 packets, 904 bytes

note the match incremented by 5

get rid of the acl that permits 192.168.4.0...

r3#sh access-list
Standard IP access list 1
    10 permit 192.168.4.128, wildcard bits 0.0.0.127

set up another acl called 2 for debugging

access-list 2 permit 192.168.4.0 0.0.0.255

debug ip policy 2

r4#ping ip 192.168.1.1 source 192.168.4.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.4.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/12/16 ms
r4#

the forwarding gets rejected... the ping obviously still gets there but through r2...

r3#       
*Aug 19 11:45:11: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, FIB policy rejected(no match) - normal forwarding
*Aug 19 11:45:11: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, FIB policy rejected(no match) - normal forwarding
*Aug 19 11:45:11: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, FIB policy rejected(no match) - normal forwarding
*Aug 19 11:45:11: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, FIB policy rejected(no match) - normal forwarding
*Aug 19 11:45:11: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, FIB policy rejected(no match) - normal forwarding

now plug the permit 4.0 back into acl 1...

r3#sh access-list
Standard IP access list 1
    10 permit 192.168.4.0, wildcard bits 0.0.0.127
Standard IP access list 2
    10 permit 192.168.4.0, wildcard bits 0.0.0.255 (19 matches)

r4#ping ip 192.168.1.1 source 192.168.4.1         
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.4.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/8/12 ms

r3#
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, FIB policy match
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, PBR Counted
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, g=172.16.13.1, len 100, FIB policy routed
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, FIB policy match
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, PBR Counted
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, g=172.16.13.1, len 100, FIB policy routed
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, FIB policy match
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, PBR Counted
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, g=172.16.13.1, len 100, FIB policy routed
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, FIB policy match
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192
r3#.168.1.1, len 100, PBR Counted
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, g=172.16.13.1, len 100, FIB policy routed
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, FIB policy match
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, len 100, PBR Counted
*Aug 19 11:53:31: IP: s=192.168.4.1 (Serial1/3), d=192.168.1.1, g=172.16.13.1, len 100, FIB policy routed
r3#

r3#sh route-map
route-map r3r1, permit, sequence 10
  Match clauses:
    ip address (access-lists): 1
  Set clauses:
    ip next-hop 172.16.13.1
Nexthop tracking current: 0.0.0.0
172.16.13.1, fib_nh:0,oce:0,status:0

  Policy routing matches: 42 packets, 3504 bytes

it's a lot of work sometimes to get to the gravy, but it can payoff... trust me, if you are doing switch first, get the access-maps down then and there...

next...

the next one is manipulating AD... nope... i'll come back for that one... someday...

this one is about path control and pbr...

ok... the configs... if you scrape em, you are cheating yourselves...

r1

int lo1
des r1 lan
ip add 192.168.1.1 255.255.255.0

int s1/0
des r1-->r2
ip add 172.16.12.1 255.255.255.248
clock ra 128000
band 128
no shut

int s1/1
des r1-->r3
ip add 172.16.13.1 255.255.255.248
band 64
no shut

r2

int lo2
des r2 lan
ip add 192.168.2.1 255.255.255.0

int s1/0
des r2-->r1
ip add 172.16.12.2 255.255.255.248
band 128
no shut

int s1/2
des r2-->r3
ip add 172.16.23.2 255.255.255.248
clock ra 128000
band 128
no shut

r3

int lo3
des r3 lan
ip add 192.168.3.1 255.255.255.0

int s1/1
des r3-->r1
ip add 172.16.13.3 255.255.255.248
clock ra 64000
band 64
no shut

int s1/2
des r3-->r2
ip add 172.16.23.3 255.255.255.248
band 128
no shut

int s1/3
des r3--r4
ip add 172.16.34.3 255.255.255.248
clock ra 64000
band 64
no shut

r4

int lo4
des r4 lan a
ip add 192.168.4.1 255.255.255.128

int lo5
des r4 lan b
ip add 192.168.4.129 255.255.255.128

int s1/3
des r4-->r3
ip add 172.16.34.4 255.255.255.248
band 64
no shut

plug em in...

slam eigrp 1 into them, use .7 wc's for the /29's...

as my nana used to say, "you do..."

r1#sh ip eigrp neigh
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
1   172.16.13.3             Se1/1                    14 00:02:20   15  2340  0  15
0   172.16.12.2             Se1/0                    14 00:03:33   16  1170  0  13
r1#

r2#sh ip eigrp neigh
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
1   172.16.23.3             Se1/2                    12 00:02:44   20  1170  0  14
0   172.16.12.1             Se1/0                    10 00:04:11   12  1170  0  13
r2#

r3#sh ip eigrp neigh
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
2   172.16.34.4             Se1/3                    14 00:02:03   28  2340  0  3
1   172.16.23.2             Se1/2                    12 00:03:13   20  1170  0  12
0   172.16.13.1             Se1/1                    10 00:03:28   28  2340  0  14
r3#

r4#sh ip eigrp neigh
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   172.16.34.3             Se1/3                    10 00:02:28   26  2340  0  13
r4#

test em with a tcl script...

foreach address {

172.16.12.1

172.16.12.2

172.16.13.1

172.16.13.3

172.16.23.2

172.16.23.3

172.16.34.3

172.16.34.4

192.168.1.1

192.168.2.1

192.168.3.1

192.168.4.1

192.168.4.129

} { ping $address }

good... mine worked... of course if you scraped my stuff, yours did too, non-hackers...

the hard part's over...

this is something you need to do... why?  to become a greasy lightning fast monster at it... it's work...