12-12-2021
02:12 PM
- last edited on
12-14-2021
04:41 AM
by
Translator
Dear all,
I'm actually stuck implementing PBR on a N9K.
I have 4 x C93180LC-EX, 1 cluster of 2 in one site, the other cluster of 2 in another site.
Both are connected via vPC, the configurations seems pretty similars.
Both sites have FEX members
I have to implement PBR.
The "route-map" is based on an ACL permitting packets coming from one subnet to public destination, the action is to route it a "next-hop" which is a remote firewall.
The problem is that I have been able to implement it only on one cluster...when I tried to implement on both members of the other cluster, I get this message
% Could not apply PBR route-map - Redirect not supported for one of a configured next-hop
Can someone know how to deal with it ?
Thanks in advance,
Solved! Go to Solution.
12-14-2021
12:34 AM
- last edited on
12-14-2021
04:42 AM
by
Translator
Little update, we finally found the cause of the problem.
With Nexus 9300 EX series, you can't do PBR with interfaces on FEX.
Our "next-hop" was on FEX interfaces , that's why it didn't work.
As soon as we changed it and put the next hop on another core router, it worked.
12-12-2021 03:26 PM
follow
12-13-2021 04:15 AM
Hello,
can you post the route map, as well as a drawing of your topology ?
12-13-2021 04:31 AM
12-13-2021 04:45 AM
Hello,
I can only see what you post. What does the other route map look like, and what is the difference between the next hops specified in both route maps ?
Post the content of both route maps.
12-13-2021 06:18 AM
Here is the summary
Creating the access-list N9K# configure terminal N9K(config)# ip access-list ACL N9K(config-acl)# permit ip 10.1.1.0 0.0.0.255 11.0.0.0 0.255.255.255 Creating the route-map policy N9K# configure terminal N9K(config)# route-map PBR N9K(config-route-map)# match ip address ACL N9K(config-route-map)# set ip next-hop 10.2.2.2 (that's my VIP ) Applying the route-map N9K# configure terminal N9K(config)# int vlan 5 N9K(config-if)# ip policy route-map PBR
I do the exact same configuration on the 4 Nexus...
12-13-2021
07:19 AM
- last edited on
12-14-2021
04:25 AM
by
Translator
Hello,
what if you add the "load-share" option:
set ip next-hop 10.2.2.2 load-share
12-14-2021
12:34 AM
- last edited on
12-14-2021
04:42 AM
by
Translator
Little update, we finally found the cause of the problem.
With Nexus 9300 EX series, you can't do PBR with interfaces on FEX.
Our "next-hop" was on FEX interfaces , that's why it didn't work.
As soon as we changed it and put the next hop on another core router, it worked.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide