1

On a Cisco 3850 acting as network core, I have a global routing table with a single default next hop :

S*    0.0.0.0/0 [1/0] via 20.2.2.254

On that 3850 I have 2 interface vlans like :

interface Vlan1
 ip address 10.1.1.1 255.255.255.0

!
interface Vlan2
 ip address 20.2.2.2 255.255.255.0

VLAN2 is using the default route to access the WAN.

I want VLAN1 to use a different default route (10.1.1.254) to access another WAN.

I tried to set up PBR with ip default next-hop to do so.

According to Cisco.com, "the set ip default next-hop command verifies the existence of the destination IP address in the routing table, and…

  • if the destination IP address exists, the command does not policy route the packet, but forwards the packet based on the routing table.
  • if the destination IP address does not exist, the command policy routes the packet by sending it to the specified next hop.

The configuration was this :

access-list 100 permit ip 10.1.0.0 0.0.0.255 any
!
route-map VLAN1-Traffic permit 10
 match ip address 100
 set ip default next-hop 10.1.1.254
!
interface vlan 1
 ip policy route-map VLAN1-Traffic

In theory, if VLAN1 tried to reach VLAN2, it should be able to do so by using the routing table (connected routes). For any other IP address, it should be routed using PBR to the next-hop of 10.1.1.254.

However, when I applied that configuration on my 3850, connectivity between VLAN1 and VLAN2 was lost, as if only the PBR route was applied.

When I deleted that route-map, connectivity was restored.

Is there anything I'm missing regarding that issue?

1

In theory, if VLAN1 tried to reach VLAN2, it should be able to do so by using the routing table (connected routes). For any other IP address, it should be routed using PBR to the next-hop of 10.1.1.254.

No. In this case, all traffic matching the 'access-list 100' is policy routed.

Therefore, the issue is at your PBR access-list 100. You need to DENY the traffic between VLAN 1 and VLAN 2, so that the traffic from VLAN 1 to VLAN 2 will be NOT policy routed, but follows the normal routing table:

access-list 100 deny ip 10.1.1.0 0.0.0.255 20.2.2.0 0.0.0.255
access-list 100 permit ip 10.1.1.0 0.0.0.255 any

=====

I also noticed that your Interface VLAN 1 and 2 are using the IP address 10.1.1.1 (subnet mask /24) and 20.2.2.2/24 (subnet mask /24), respectively, so that in the 'access-list 100', you should have 10.1.1.0 0.0.0.255 and 20.2.2.0 0.0.0.255, NOT 10.1.0.0 0.0.0.255.

  • "No. In this case, all traffic matching the 'access-list 100' is policy routed." In that case, what's the point in using "set ip default next-hop" ? As stated above, it's supposed to forward the packet based on the routing table (and not the PBR), if the destination IP is found in it. This is the case for VLAN2 ips. – Jeremy G. Jan 31 '18 at 13:21
  • @Hung Tran: can you please explain the difference between "set ip next-hop" and "set ip default next-hop"? – mere3ortal Jan 31 '18 at 15:39
  • @JeremyG. I think I did not make my the statement clear enough. My point is that the traffic should be matched/verified against the 'access-list 100' before the 'set ip default next-hop' statement is examined. Can you please turn on 'debug ip policy' on 3850 and update your question with its output. Ensure that you use correct IP subnet. – Hung Tran Jan 31 '18 at 18:28
  • @mere3ortal I will do that later when we get more debug details from Jeremy. – Hung Tran Jan 31 '18 at 18:31
  • @HungTran: My understanding is that yes, the ACL will get matched, but the "PBR action" is "send the packet to the specified next-hop only if there is no specific route to the destination; if there is a specific route, use the specific route". In this case, since the destination IP address is directly connected (on Vlan2), i.e. we have a specific route, the packets destined to 20.2.2.0/24 should take the specific route. – mere3ortal Feb 1 '18 at 2:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.