I am trying to configure a policy based route on a brocade VDX (NOS operating system) to direct traffic based on destination subnet.
I want traffic going from 10.5.2.0/23 to 10.5.1.0/25 to be routed by the VE configured on the switch (10.5.2.1)
I want traffic going from 10.5.2.0/23 to anywhere ELSE to go through a pfsense box which is a firewall/router. (10.5.2.2)
To do this I have configured two ACLS specifying source and destination networks
The first says permit traffic from 10.5.2.0/23 to 10.5.1.0/25
show access-list ip emgap01ToStorage in ip access-list emgap01ToStorage on Ve 3020 at Ingress (From PBR) seq 10 permit ip 10.5.2.0 255.255.254.0 10.5.1.0 255.255.255.128 (Active)
The next says permit traffic from 10.5.2.0/23 to ANY
show access-list ip emgap01ToFirewall in ip access-list emgap01ToFirewall on Ve 3020 at Ingress (From PBR) seq 10 permit ip 10.5.2.0 255.255.254.0 any (Active)
I then apply a route map to these two rules.
First is sequence 10, if traffic matches the first ACL, route normally through the VE assigned
If traffic is not going to the network specified in that acl, it should go to seq 20 which sets the next hop to 10.5.2.2
show route-map emgap Interface Ve 3020 ip policy route-map emgap permit 10 (Active) match ip address acl emgap01ToStorage set ip next-hop 10.5.2.1 Policy routing matches: 0 packets Note: Counter values are partial Interface Ve 3020 ip policy route-map emgap permit 20 (Active) match ip address acl emgap01ToFirewall set ip next-hop 10.5.2.2 (selected) Policy routing matches: 0 packets Note: Counter values are partial
In this configuration, the route does not seem to be applied, traffic is never passed to the firewall (10.5.2.2)
I may have two problems here
- I simply wrote the ACLS wrong (Possible because the PBR shows 0 packets matching the policy?)
- The router is not sending traffic to the firewall because it is unaware that 10.5.2.2 is a router. Since it's a pfsense box, the brocade is somehow unaware that 10.5.2.2 can route things.
Here is the running config for the route map
route-map emgap permit 10 match ip address acl emgap01ToStorage set ip next-hop 10.5.2.1 ! route-map emgap permit 20 match ip address acl emgap01ToFirewall set ip next-hop 10.5.2.2
And a basic picture of my desired topology