PBR reverse traffic

[hikari-no-kumo]

Hello

I have a question.

from one location i.e. Site1 I need to separate some traffic from another.

Moreover due to the fact the company has a lot of other offices I have to restrict traffic to choosing OTHER routes (could be used due to outages or routing changes). 

Thus the only feasible option is to use special VRF tunnel between Site1 and Site2.

Traffic selection to VRF tunnel is based on destination host and tcp ports. 

so the traffic from Site1 is now being routed by ASA (using static route to destination). Then on border router is gets into VLAN+VRF, afterwards goes to tunnel. 

On Site2 traffic comes out of VRF tunnel, then I do route leaking

ip route vrf x.x.x.x y.y.y.y d.d.d.d global

and then flows to destination server.

Now I hit the problem with reverse traffic. 

Originally, I was going to put the traffic from GRT back to VRF tunnel using PBR 

But.... it doesn't work

I see zero hits in ACL and PBR operation.

Moreover, traffic capture shows the traffic is going back from Site2 to Site1 via GRT. 

So PBR applied to incoming reverse traffic (from destination server back to Site1) doesn't work at all.

Can you please advice me why did it happen?

Thank you in advance.

Best regards, Vladimir

[hikari-no-kumo · Accepted solution]

Problem solved:

PBR works when 

set vrf—Routes packets through a specified VRF instance. The router looks for the outgoing interface in the VRF table.

Mine mistake was to use initially:

set ip vrf—Causes the router to look up the next hop in the VRF table.