They are on same subnet and has following config but does not work on the ASA
access-list Test-ACL extended permit ip any object-group Test
route-map Test-Routemap permit 10
match ip address Test-ACL
set ip default next-hop 192.168.1.3 (192.168.1.3 is the R1 where backup internet is connected)
assume 192.168.1.1 is core switch and 192.168.1.2 is firewall
if I do a traceroute from R1 to address where I want to go, its routing out locally through backup internet so i know that circuit works
is there anything that i am missing?
Just did a packet tracer and see its being denied as second phase as Access-List dropped
Test(config-pmap-c)# packet-tracer input inside tcp 192.168.1.100 80 13.67.180.4
Phase: 1
Type: PBR-LOOKUP
Subtype: policy-route
Result: ALLOW
Config:
route-map Test-Routemap permit 10
match ip next-hop Test
set ip next-hop 192.168.1.3
Additional Information:
Matched route-map Test-routemap sequence 10, permit
Found next-hop 192.168.1.3 using egress ifc inside
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7f90370a9f90, priority=111, domain=permit, deny=true
hits=32401, user_data=0x0, cs_id=0x0, flags=0x4000, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=inside
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
