Policy Based Routing from Cat 4500 to ACI

[delpo40]

Hi,

I am trying to policy route traffic from a 4500 switch to ACI. The 4500-ACI link is a vlan trunked L2 out. The next-hop in the route-map is a (VM - ESX) host that sits on one of these vlans, connected to ACI. The IP and mac of the host are visible to the 4500 and routing to the host works fine if the destination IP is the specified host.

However the route-map is not redirecting the traffic. The acl is correct. Are there any limitations to this set up that anyone is aware of? Does any additional config need to be carried out on the ACI side?..

[paul driver]

Hello
Can you post the cfg from that core switch please
sh run | in access-list
sh run | in route-map
sh ip route connected
sh ip cef <scr ip>
sh ip cef <dst ip>

[delpo40]

Hi -output below..

Extended IP access list Web-Filter
10 permit tcp host 10.154.66.107 any eq www
20 permit tcp host 10.154.66.107 any eq 443

!!!
route-map Web-Filter, permit, sequence 10
Match clauses:
ip address (access-lists): Web-Filter
Set clauses:
ip next-hop 172.18.129.203
!!!

#sh ip route connected | i 172.18.129
C 172.18.129.128/25 is directly connected, Vlan702
L 172.18.129.253/32 is directly connected, Vlan702

#sh ip cef 10.154.66.107
10.154.64.0/21
nexthop 172.18.131.6 TenGigabitEthernet1/6/1

SSN-C4507-CH#sh ip cef 172.18.129.203
172.18.129.203/32
attached to Vlan702

interface TenGigabitEthernet1/6/1
ip policy route-map Web-Filter

[paul driver]

Hello
Maybe try splitting the acl into two PBR stanzas and appending a catch all 

ip access-list extended http_acl
permit tcp host 10.154.66.107 any eq www

ip access-list extended https_acl
 permit tcp host 10.154.66.107 any eq 443

route-map PBR_rm permit 
match ip address http_acl
set ip next-hop 172.18.129.203

route-map PBR_rm permit 20
match ip address https_acl
set ip next-hop 172.18.129.203

route-map PBR_rm permit 100