Policy Base Routing Using Route-maps not working

Question

What i wanna do is that.
If a traffic at F0/1 of R1 comes in for any source but destination 202.100.30.248/29 then the next hop shall be 192.168.1.1

Both R3 and R2 have default static route designated towards R1 router so i'm able to ping 192.168.1.1 from Router R3.

But when i try to ping 200.100.30.252 from R3 i don't get reply infact i want to know that my PBR works and forwards the packets or not.The 200.100.30.252 isn't in the R1 routing table.There is no routing protocol running.

Here is what i configure on R1

    route-map PBR, permit, sequence 10
          Match clauses:
            ip address (access-lists): 104 
          Set clauses:
            ip default next-hop 192.168.1.1

    Extended IP access list 104
        10 permit ip any 202.100.30.248 0.0.0.7 log-input

   interface FastEthernet0/1
   ip address 172.16.1.2 255.255.255.252
   ip policy route-map PBR

R1 configuration

R1#sh running-config 
Building configuration...
Current configuration : 1295 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
no ip icmp rate-limit unreachable
!
!
ip cef
no ip domain lookup
!
ip tcp synwait-time 5
!
interface FastEthernet0/0
 ip address 192.168.1.2 255.255.255.252
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 172.16.1.2 255.255.255.252
 ip policy route-map PBR
 duplex auto
 speed auto
!
interface FastEthernet1/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet1/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
ip forward-protocol nd
!
no ip http server
!
!
access-list 104 permit ip any 202.100.30.248 0.0.0.7 log-input
no cdp log mismatch duplex
!
route-map PBR permit 10
 match ip address 104
 set ip default next-hop 192.168.1.1
!
control-plane
!
gatekeeper
 shutdown
!
!         
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
 stopbits 1
line vty 0 4
 login
!
!
end

I analyze Packets from R3 to R1 and it only shows ARP broadcast asking for who is 202.100.30.252 and there is no reply coming back for that ARP.
May be I'm doing a big blunder i'm learning about this please correct me for my mistakes. If you need anything more just ask.

Answer 1

You wrote

Both R3 and R2 have default static route designated towards R1 router...

And you also wrote:

I analyze Packets from R3 to R1 and it only shows ARP broadcast asking for who is 202.100.30.252 and there is no reply coming back for that ARP.

OK, so why is R3 ARPing for 202.100.30.252? Shouldn't it just send the ICMP packet towards R1? Well, that's because you have this on R3:

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0

which is not quite the same thing as:

ip route 0.0.0.0 0.0.0.0 172.16.1.2

You can look up the details but to cut a long story short, the first form depends on Proxy ARP behavior on R1. And here is the thing: R1 does not have an IP route to the ultimate destination (202.100.30.248/29); it only has a PBR rule. As a consequence, R1 remains silent when the ARP request arrives, and therefore R3 does not send the ICMP packet towards R1.

Answer 2

I am afraid that the interface f1/0 (with IP 200.100.30.252/29) on R2 is NOT really up, causing the issue. Please check it again.

And please use the next-hop IP addresses for all static default routes

The configuration on R1 looks good as I used that to reproduce the following case and I can ping both IPs 200.100.30.251 and 200.100.30.252 from R3.

Configuration on routers:

R1:

R1#
interface FastEthernet0/0
 ip address 192.168.1.2 255.255.255.252
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 172.16.1.2 255.255.255.252
 ip policy route-map PBR
 duplex auto
 speed auto
!
access-list 104 permit ip any 202.100.30.248 0.0.0.7 log-input

route-map PBR permit 10
 match ip address 104
 set ip default next-hop 192.168.1.1


R1#show ip route | beg Gateway
Gateway of last resort is not set

     172.16.0.0/30 is subnetted, 1 subnets
C       172.16.1.0 is directly connected, FastEthernet0/1
     192.168.1.0/30 is subnetted, 1 subnets
C       192.168.1.0 is directly connected, FastEthernet0/0
R1#

R3:

interface FastEthernet0/1
 ip address 172.16.1.1 255.255.255.252
 duplex auto
 speed auto
!
ip route 0.0.0.0 0.0.0.0 172.16.1.2

R2:

interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.252
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 202.100.30.252 255.255.255.248
 duplex auto
 speed auto
!
ip route 0.0.0.0 0.0.0.0 192.168.1.2

R4:

interface FastEthernet0/1
 ip address 202.100.30.251 255.255.255.248
 duplex auto
 speed auto
!
ip route 0.0.0.0 0.0.0.0 202.100.30.252

Verification

On R3, pinging to 200.100.30.251 and 200.100.30.252 are successful:

R3#ping 202.100.30.252

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.30.252, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 120/128/148 ms
R3#ping 202.100.30.251

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 202.100.30.251, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 96/131/164 ms

On R1, log messages are generated:

R1#
%SEC-6-IPACCESSLOGDP: list 104 permitted icmp 172.16.1.1 (FastEthernet0/1 ) -> 202.100.30.252 (0/0), 10 packets                                                                       
%SEC-6-IPACCESSLOGDP: list 104 permitted icmp 172.16.1.1 (FastEthernet0/1 ) -> 202.100.30.251 (0/0), 20 packets

Updated answer:

1. When we use (outgoing-) exit-interface for a static route, R3 router "thinks" that it is directly connecting to destination network (here is 0.0.0.0/0 including the IP 200.100.30.252 in 200.100.30.248/29), thus the router sends the ARP request for that destination IP (src: 172.16.1.1 and des: 200.100.30.252) out of that exit-interface after the first ping.

   When the ARP request reaches R1, R1 has no idea about the destination IP 202.100.30.252. Therefore it does not do anything.

   The ARP entry for the destination 202.100.30.252 cannot be created on R3, all ICMP packets failed at encapsulation and are not sent out.

2. When we use next-hop IP address for a static route, R3 router knows that it has to route traffic to R1's IP address 172.16.1.2 and it needs an ARP entry for this IP address. Therefore the router sends only the ARP request for that next-hop IP (src: 172.16.1.1 and des: 172.16.1.2) out of directly connected interface after the first ping.

   When the ARP request reaches R1, R1 replies because the IP address 172.16.1.2 is on its directly connected interface.

   The ARP entry for next-hop IP address 172.16.1.2 is created on R3, the second and rest of ICMP packets are sent out. These ICMP packets are verifed against PBR on R1.