Let's say all the routers in this example are configured in a linear fashion. We have routers
A through Z in this enterprise network. Now, we have an ACL configured that blocks access from
RA to RZ. When a host on the Ethernet segment attached to RA, wants to send a packet to RZ, the host
will first realize that the destination is not local and will use the ARP entry for the default
gateway OR it will ARP for the mac address of the default gateway. THe host will then construct
a frame which will then travel towards the default gateway of the ethernet segment on RA. Once
the router receives this frame, it will then knock off the frame, and look at the IP header for
the destination IP address. Once it has this information, the ACL which was configured inbound
on RA's Ethernet interface, will see that this is a match, and will deny the packet to travel
further to the destination. Of course we will put in an 'ip permit any any' at the end of this
ACL otherwise all traffic will be blocked.
Now, in this example, we have PBR configured to allow the Ethernet segment on RA to use the
second link to RB, on it's way towards an attached ethernet segment on RZ. Host A will notice
that the destination is not local, will use the ARP entry in the ARP table OR if an entry does
not exist, will ARP for the MAC of the default gateway on RA. The host will construct a frame
and send it to the destination mac address of the default gateway on RA. Once RA receives this
frame it knocks off the frame, and looks at the destination IP address in the IP header of the
IP Packet. The PBR process on the router, notices that it matches the PBR configuration, and
uses the ARP table entry for the next-hop ip address in the PBR, OR ARPs for the mac address
for the next-hop ip address if it does not have one. It when constructs a frame with this
mac address as the destination mac address and the source mac address as the source of the
interface that sent the frame from RA.
Remember that the source ip address/destination ip address do not change unless you're using
NAT, but the router will remember the NAT translation so that's ok. The source mac and destination
mac will change hop to hop.
I hope that helped some.
I'm not too familiar with rate limiting so I'll let someone else answer that one.
