Route Map and failed to locate egress interface on ASA 5516

[DanieleParodi]

Hi everyone

I have a big problem with my route map which is not working as it should.
From a remote ASA which has ip 10.73.10.11 I have to reach a host on another ASA which has IP 10.13.166.132 (subsequently it will have to reach the whole subnet 10.13.166.128/25 but now I am using only one IP for testing because the subnet is already in production).
For the Host 10.13.166.132 I configured a MAP route which I then applied on the interface which provides that for the destination 10.73.10.11 it must use the IP 192.168.131.225 as next-hop which is a more performing MPLS connection than the primary connectivity .
The problem is that if from host 10.13.166.132 I execute a telnet on port 80 vs 10.73.10.11 the connection is ok while if I try a telnet from 10.73.10.11 vs 10.13.166.132 this is not ok and it is a problem because 10.73. 10.11 (citrix server) fails to register the PC. From the attached logs you can see what the result is, a "routing failed to locate egress interface."
The NEXT-HOP is configured in the route map which is 192.168.131.225.
It seems that there is no established between the two hosts, that is, as if the destination host initiated a new connection towards 10.73.10.11 but also in this case the packet should arrive at its destination precisely for the configuration of the route map.
Attached is the configuration of the ASA and the screen shot of the logs.
Considering that by applying the default routing the telnet from 10.73.10.11 vs 10.13.166.132 (obviously without the route map applied) is successful.

Can anyone help me understand if and where there is an error?

Thanks in advance

Daniele

[MHM Cisco World]

PBR_ <- this use in name of match ACL but I don't see any ACL start with this.
I thing this is issue here 

[DanieleParodi]

Hi

thanks for the reply but in the attached file there is the ACL named PBR_AC_UNICO at line 1815

"access-list PBR_AC_UNICO extended permit ip host 10.13.166.132 object-group DM_INLINE_NETWORK_73"

Greetings

 Regards

[DanieleParodi]

I also add two zipped files  that are 2 pcap files to open with Wireshark and a screenshot of the capture made on the two interfaces.

Thanks

[chadbaird2431]

The other person was mentioning you're missing the ACL called PBR_AC_UNICO, not the access list called PBR_AC_UNICO...  

There is no access group called PBR_AC_UNICO either, which would be the name of the Access-list applied to any interface.  

So you want an ACL called PBR_AC_UNICO. Call the access list whatever the name if the interface is. Then like below, apply the access-group to the interface. That subnet appear to be called object-group network DM_INLINE_NETWORK_65(it's like that because it's not named) Not sure which interface this is from but that should be the access list you would use to define this network in. 

access-group MPLS_access_in in interface PTPSDWAN
access-group SERVER_access_in in interface SERVER
access-group SERVICE_access_in in interface SERVICE
access-group CMD_access_in in interface CMD
access-group VOIP_ENT_access_in in interface VOIP_ENT
access-group IBERDROLA_access_in in interface IBERDROLA
access-group O_FIBER_access_in in interface O_FIBER
access-group AC_UNICO_access_in in interface AC_UNICO
access-group PRINTERS_access_in in interface PRINTERS
access-group BAT_access_in in interface BAT
access-group ACEA_access_in in interface ACEA
access-group FCA_access_in in interface FCA
access-group PTP-CMDINPS_access_in in interface PTP-CMDINPS
access-group DELTA_access_in in interface DELTA
access-group FASTWEB_access_in in interface FASTWEB
access-group PTPFASTWEB_access_in in interface PTPFASTWEB
access-group MPLS-AU_access_in in interface MPLS-AU
access-group global_access global
!

Let me know  if this clears things up.