Brocade PBR next hop to firewall based on network destination

Question

I am trying to configure a policy based route on a brocade VDX (NOS operating system) to direct traffic based on destination subnet.

I want traffic going from 10.5.2.0/23 to 10.5.1.0/25 to be routed by the VE configured on the switch (10.5.2.1)

I want traffic going from 10.5.2.0/23 to anywhere ELSE to go through a pfsense box which is a firewall/router. (10.5.2.2)

To do this I have configured two ACLS specifying source and destination networks

The first says permit traffic from 10.5.2.0/23 to 10.5.1.0/25

show access-list ip emgap01ToStorage in
ip access-list emgap01ToStorage on Ve 3020 at Ingress (From PBR)
seq 10 permit ip 10.5.2.0 255.255.254.0 10.5.1.0 255.255.255.128 (Active)

The next says permit traffic from 10.5.2.0/23 to ANY

show access-list ip emgap01ToFirewall in
ip access-list emgap01ToFirewall on Ve 3020 at Ingress (From PBR)
seq 10 permit ip 10.5.2.0 255.255.254.0 any (Active)

I then apply a route map to these two rules.

First is sequence 10, if traffic matches the first ACL, route normally through the VE assigned

If traffic is not going to the network specified in that acl, it should go to seq 20 which sets the next hop to 10.5.2.2

show route-map emgap
Interface Ve 3020
ip policy route-map emgap permit 10 (Active)
match ip address acl emgap01ToStorage
set ip next-hop 10.5.2.1
Policy routing matches: 0 packets     Note: Counter values are partial

Interface Ve 3020
ip policy route-map emgap permit 20 (Active)
match ip address acl emgap01ToFirewall
set ip next-hop 10.5.2.2 (selected)
Policy routing matches: 0 packets     Note: Counter values are partial

In this configuration, the route does not seem to be applied, traffic is never passed to the firewall (10.5.2.2)

I may have two problems here

1. I simply wrote the ACLS wrong (Possible because the PBR shows 0 packets matching the policy?)
2. The router is not sending traffic to the firewall because it is unaware that 10.5.2.2 is a router. Since it's a pfsense box, the brocade is somehow unaware that 10.5.2.2 can route things.

Here is the running config for the route map

route-map emgap permit 10
match ip address acl emgap01ToStorage
set ip next-hop 10.5.2.1
!
route-map emgap permit 20
match ip address acl emgap01ToFirewall
set ip next-hop 10.5.2.2

And a basic picture of my desired topology

Answer 1

Turns out that in NOS 4.1.2 PBR is broken if your next hop traverses port-channel or VLAG.

In this case the 10.5.2.2 router is accessed over an LACP trunk from 10.5.2.1 router, which breaks the PBR

This is fixed in firmware 4.1.3