Cisco PBR Default Next-Hop – Dual WAN Access

ciscopbrrouting

On a Cisco 3850 acting as network core, I have a global routing table with a single default next hop : 

S*    0.0.0.0/0 [1/0] via 20.2.2.254

On that 3850 I have 2 interface vlans like : 

interface Vlan1
 ip address 10.1.1.1 255.255.255.0

!
interface Vlan2
 ip address 20.2.2.2 255.255.255.0

VLAN2 is using the default route to access the WAN.

I want VLAN1 to use a different default route (10.1.1.254) to access another WAN.

I tried to set up PBR with ip default next-hop to do so.

According to Cisco.com, "the set ip default next-hop command verifies the existence of the destination IP address in the routing table, and…

  • if the destination IP address exists, the command does not policy route the packet, but forwards the packet based on the routing table.
  • if the destination IP address does not exist, the command policy routes the packet by sending it to the specified next hop.

The configuration was this : 

access-list 100 permit ip 10.1.0.0 0.0.0.255 any
!
route-map VLAN1-Traffic permit 10
 match ip address 100
 set ip default next-hop 10.1.1.254
!
interface vlan 1
 ip policy route-map VLAN1-Traffic

In theory, if VLAN1 tried to reach VLAN2, it should be able to do so by using the routing table (connected routes).
For any other IP address, it should be routed using PBR to the next-hop of 10.1.1.254.

However, when I applied that configuration on my 3850, connectivity between VLAN1 and VLAN2 was lost, as if only the PBR route was applied.

When I deleted that route-map, connectivity was restored.

Is there anything I'm missing regarding that issue?

Best Answer

In theory, if VLAN1 tried to reach VLAN2, it should be able to do so by using the routing table (connected routes). For any other IP address, it should be routed using PBR to the next-hop of 10.1.1.254.

No. In this case, all traffic matching the 'access-list 100' is policy routed.

Therefore, the issue is at your PBR access-list 100. You need to DENY the traffic between VLAN 1 and VLAN 2, so that the traffic from VLAN 1 to VLAN 2 will be NOT policy routed, but follows the normal routing table:

access-list 100 deny ip 10.1.1.0 0.0.0.255 20.2.2.0 0.0.0.255
access-list 100 permit ip 10.1.1.0 0.0.0.255 any

=====

I also noticed that your Interface VLAN 1 and 2 are using the IP address 10.1.1.1 (subnet mask /24) and 20.2.2.2/24 (subnet mask /24), respectively, so that in the 'access-list 100', you should have 10.1.1.0 0.0.0.255 and 20.2.2.0 0.0.0.255, NOT 10.1.0.0 0.0.0.255.

Related Topic