"d=255.255.255.255 (nil)" result in PBR

[robad]

Hi,

I'm having some other open post that still running for another aspect of the issue.

Here I want to know what is this issue :

I'm having policy based route from Group-A to Group-B

I've run the command

debug ip policy

and I'm getting some strange result........

Pings between groups are not working....

When trying "traceroute" from some host in no matters which group, even to it's gateway [that ping is working], this is the result :

IP: s=43.43.43.20 (Vlan140), d=255.255.255.255 (nil), len 70, policy rejected -- normal forwarding IP: s=43.43.43.20 (Vlan140), d=255.255.255.255 (nil), len 70, policy rejected -- normal forwarding IP: s=43.43.43.20 (Vlan140), d=255.255.255.255 (nil), len 70, policy rejected -- normal forwarding IP: s=43.43.43.20 (Vlan140), d=255.255.255.255 (nil), len 70, policy rejected -- normal forwarding IP: s=43.43.43.20 (Vlan140), d=255.255.255.255 (nil), len 70, policy rejected -- normal forwarding 

 The very strange thing is : d=255.255.255.255 (nil)

never saw it. 

Here is my config :

Extended IP access list A-to-B
10 permit ip 43.43.43.0 0.0.0.255 40.40.40.0 0.0.0.255
Extended IP access list A-to-any
10 permit ip 43.43.43.0 0.0.0.255 any

Extended IP access list B-to-A
10 permit ip 40.40.40.0 0.0.0.255 43.43.43.0 0.0.0.255
Extended IP access list B-to-any
10 permit ip 40.40.40.0 0.0.0.255 any

route-map A sequence 5
match ip add A-to-B
set ip next-hop 40.40.40.1

route-map A sequence 10
match ip add A-to-any
set ip next-hop [IT uplink address]


route-map B sequence 5
match ip add B-to-A
set ip next-hop 43.43.43.1

route-map B sequence 10
match ip add B-to-any
set ip next-hop [IT uplink address]

And of course that the ip-policy applied on the Vlans

BTW - I'm running : 

The 9600 is : 9606R

Version : (CAT9K_IOSXE), Version 17.3.4

Which I've asked about it here : https://community.cisco.com/t5/routing/pbr-bug-did-it-fixes-in-bagaluru-version/m-p/4649425#M369875

Thanks in advance 

[MHM Cisco World · Accepted solution]

you config is excellent except some point 
in Core SW you need only one VLAN for example VLAN 100
you all VLAN in trunk between access SW and Core
you need to add VLAN 100 to access SW also.
Now do routing policy or doing static route toward the SVI of VLAN 100 in core
and that it.

one more point
please select different VLAN number in both Access SW I see VLAN 20 in both Acces SW that wrong.

[robad]

Hi !

1. I must leave now so I'll read it more carefully tomorrow, but , just mentioning, that now IT IS WORKING in our old setup [with 6500] 
2. What do you call the core sw ? the 9600 ?
3. (and about Vlan 20, it's a type, I've changed it in the draw - thanks )

[MHM Cisco World]

Yes Core SW is 9600
and please can I see the PBR you use

[robad]

MHM, The config can be found here [copied from the original message] :

Extended IP access list A-to-B
10 permit ip 43.43.43.0 0.0.0.255 40.40.40.0 0.0.0.255
Extended IP access list A-to-any
10 permit ip 43.43.43.0 0.0.0.255 any

Extended IP access list B-to-A
10 permit ip 40.40.40.0 0.0.0.255 43.43.43.0 0.0.0.255
Extended IP access list B-to-any
10 permit ip 40.40.40.0 0.0.0.255 any

route-map A sequence 5
match ip add A-to-B
set ip next-hop 40.40.40.1

route-map A sequence 10
match ip add A-to-any
set ip next-hop [IT uplink address]


route-map B sequence 5
match ip add B-to-A
set ip next-hop 43.43.43.1

route-map B sequence 10
match ip add B-to-any
set ip next-hop [IT uplink address]

[MHM Cisco World]

[Richard Burts]

I am not clear what the issue about PBR is. But I believe that we can address one aspect of the original post. The references to 255.255.255.255 are equivalent to the broadcast address and are the result of logic in the acl that matches "any" such as this

10 permit ip 43.43.43.0 0.0.0.255 any 

[robad]

Thanks Richard for the clarification

[robad]

Hi,

Thanks @MHM Cisco World  @Richard Burts for your replies

At the end, we've chose to use a different vlan for routing between labs, and keep route-maps only for outgoing packets to IT

Thanks a lot !

BTW -

Can someone help with this question ?

 https://community.cisco.com/t5/routing/pbr-bug-did-it-fixes-in-bagaluru-version/m-p/4649425#M369875

[Richard Burts]

Thanks for the update. Glad that you have something that works for you.