I've found a couple of links (easier explanation, more detailed one) that attempt to explain the concept of access lists and route maps. If I understood correctly, their behaviour largely depends on where and how access lists and route maps are used.

However I can't grasp the concept of permit/deny options.

The route map statements can also be marked with a deny. If the statement is marked as a deny, the packets meeting the match criteria are sent back through the normal forwarding channels (in other words, destination-based routing is performed). Only if the statement is marked as permit and the packets meet the match criteria are all the set clauses applied. If the statement is marked as permit and the packets do not meet the match criteria, then those packets are also forwarded through the normal routing channel.

Okay, that makes sense. But what about this:

Router(config)# access-list 1 permit
Router(config)# route-map MYMAP permit 10
Router(config-route-map)# match ip address 1
Router(config-route-map)# set ip next-hop 

There is permit in 1st and 3rd line. If the ip address matched, then its next hop is set to Fine.

What if I set it to permit, deny respectively? Or deny, permit? Or deny, deny? What would happen in such cases? I'm guessing, that the result after setting both to deny would be the same as setting both to permit.

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 13, 2017 at 3:06

2 Answers 2


You need to remember that always will be an implicit DENY into every access-list. On the same way, if you put a deny statement onyour route-map, something like this:

xx#ip access-list 10 permit some_ip

xx#route-map TO_EXPLAIN deny 10
xx(config-route-map)#match ip access-list 10
xx(config-route-map)#set ip next-hop xyz

With this, the route map will never will do nothing 'cause the deny statement. If you want that a route map try to match something, your statement need to be a permit on some way.

  • See the last comment (by sclinton): supportforums.cisco.com/discussion/11204856/… He used deny in route-map, but he claims that not everything will be blocked.
    – user299869
    Jan 22, 2016 at 18:11
  • Oh i see, it never cross my mind do that before, that is the reason why you can try to simulate that on GNS3 Jan 22, 2016 at 19:35
  • Well I'm not saying it's correct or not, but I think he made a mistake: what he probably meant was If you perform a deny on an ACL and then perform a deny on a route map, it will allow what you denied and deny what you permitted
    – user299869
    Jan 22, 2016 at 19:59
  • I guess he might be wrong though. Notice what Cisco says: If you use an ACL in a route-map permit or deny clause, and the ACL denies a route, then the route-map clause match is not found and the next route-map clause is evaluated. (source) In his example, ACL denies that route. So it will simply not match that route-map.
    – user299869
    Jan 22, 2016 at 20:02
  • That is what i think about that, in fact, that is the reason why route-maps gave us the opportunity to put one or more statements. Jan 22, 2016 at 20:14

Access Lists specify particular traffic.

Policy-Based Routing is a feature for overriding the routing table / forwarding mechanism for all traffic matching an access list.

A couple of key points:

  1. You specify PBR on the incoming interface.
  2. Packets that are generated by the router (such as ping) are not normally policy-routed.
  3. Logical and / or concepts including subnet masking and wildcard masking are applicable.

see cisco.com: Configuring Policy-Based Routing

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.