Trace route behavior in ACI PBR one arm mode

[Jaya_tv]

Hello everyone,

we have PBR with one-arm mode.
Service Node [ Firewall ] is connected with Leaf 01 and 02.
Consumer EPG is with Leaf 03 and Provider EPG is with Leaf 04.
From Consumer I am able to Ping Provider.
Traceroute from consumer EPG to Provider EPG takes 5 hops.
Traffic is hitting a firewall and return to ACI without any issues.
I would like to understand why consumer to provider traffic is taking 5 hops?
I had gone thru one whitepaper whcih says traceroute is not best options to verify PBR traffic.

[Sergiu.Daniluk]

Hi @Jaya_tv ,

Could you share the output of the traceroute and indicate what each IP represents in the output? Also, is your firewall go-to or go-through?

Cheers,

Sergiu

[Gaurav Gambhir]

Refer to traceroute consideration for PBR

https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739971.html#_Toc522749020)

there was this bug which is fixed in 3.2x

CSCvh92923 ACI PBR does not decrement TTL