Can't apply PBR on Nexus 9300

[AK59]

Dear all, 

I'm actually stuck implementing PBR on a N9K.

I have 4 x C93180LC-EX, 1 cluster of 2 in one site, the other cluster of 2 in another site. 

Both are connected via vPC, the configurations seems  pretty similars.

Both sites have FEX members

I have to implement PBR.

The "route-map" is based on an ACL permitting packets coming from one subnet to public destination, the action is to route it a "next-hop" which is a remote firewall. 

The problem is that I have been able to implement it only on one cluster...when I tried to implement on both members of the other cluster, I get this message 

% Could not apply PBR route-map - Redirect not supported for one of a configured next-hop

Can someone know how to deal with it ? 

Thanks in advance,               

[MHM Cisco World]

follow

[Georg Pauwen]

Hello,

can you post the route map, as well as a drawing of your topology ?

[AK59]

Hello,

You'll find attached the scheme.

The policy route map say that if the flow comes from sources server to a specified destination, then set the next hop to VIP 1 .

[Georg Pauwen]

Hello,

I can only see what you post. What does the other route map look like, and what is the difference between the next hops specified in both route maps ?

Post the content of both route maps.

[AK59]

Here is the summary 

Creating the access-list 

N9K# configure terminal

N9K(config)# ip access-list ACL

N9K(config-acl)# permit ip 10.1.1.0 0.0.0.255  11.0.0.0 0.255.255.255



Creating the route-map policy



N9K# configure terminal

N9K(config)# route-map PBR

N9K(config-route-map)#  match ip address ACL

N9K(config-route-map)#  set ip next-hop 10.2.2.2 (that's my VIP )



Applying the route-map

 

N9K# configure terminal

N9K(config)#  int vlan 5

N9K(config-if)#  ip policy route-map PBR

I do the exact same configuration on the 4 Nexus...

[Georg Pauwen]

Hello,

what if you add the "load-share" option:

set ip next-hop 10.2.2.2 load-share

[AK59 · Accepted solution]

Little update, we finally found the cause of the problem. 

With Nexus 9300 EX series, you can't do PBR with interfaces on FEX. 

Our "next-hop" was on FEX interfaces , that's why it didn't work. 

As soon as we changed it and put the next hop on another core router, it worked.