Cannot apply a policy-map on interface because of Flowspec IOS XR

[Louey]

Hi 

I need to apply a policy on my router interface to change the next-hop for some packet source IPs so it could be redirected to a specific transit. I applied a Policy-map PBR on an ingress interface on Cisco XR ASR9000 but the commit does not work and here is the log :

!! SEMANTIC ERRORS: This configuration was rejected by

!! the system due to semantic errors. The individual

!! errors with each failed configuration command can be

!! found below.

interface Bundle-Ether2.10

 service-policy type pbr input PM_IP_SFR_Sortie_NAT

!!% 'PBR' detected the 'warning' condition 'BGP FS policy already applied to an interface or traditional policy applied to an interface'

!

Flowspec is enabled on all interfaces for DDoS and we cannot disable it.

Someone can help with this please ?

Regards

Louey

[Stratforders]

That’s an useful feature because we can develop a program executed on the router itself to convert the flowspec rules received into configuration line. That’s exactly what the bgpfs2acl script is doing. 

MyGeorgiaSouthern.edu

[fssabati]

Hi @Louey 

Can you please share the configuration of that interface .

Regards 

Sharanya 

[Louey]

Hi 

Here is the interface config :

interface Bundle-Ether2.10
description Server: VLAN10 - Interco Public_Network_and_Transit9
ipv4 mtu 1500

ipv4 address 10.10.10.1 255.255.255.192

encapsulation dot1q 10

ex

And here is the policy-map

policy-map type pbr PM_IP_SFR_Sortie_NAT
class type traffic CM_IP_SFR_Sortie_NAT
redirect ipv4 nexthop x.x.x.x

ex
!

[marce1000]

  - Review this thread : https://community.cisco.com/t5/routing/got-error-when-applying-pbr-on-asr9010/td-p/4076635

 M.

[Louey]

No solution on the post unfortunately.

Thanks