PBR Policy Based Routing issue

[renemerki1]

Hi 

I've a problem at a customer.
The customer has Router in Romania. He has 2 connectivity. One Internet connection and one "Carrier line for Voice (Lync,Business Skype) Traffic only".
The Problem we have is following. On the Router 1941 we want to make PBR based on the Policy UDP/TCP ports. (Attached config file).
Voice Traffic from Head-End in Switzerland is passing the correct way through the Carrier line but from Romania to the Head-End it goes over the VPN tunnel (Internet).
could you have a look at the config and maybe help us, why the Policy based ACL is not working ?
We see only 50 kbit/s on this connection but from Switzerland to Romania up to 2 Mbit/s.

Many thanks for your support.

Regards

René

[enter2014 · Accepted solution]

Rene,

From the config it looks like your input interface is G0/1.373 and the desired PBR output is G0/0/0?

I would just verify that the access-list is catching the right ports. Can you use a source destination without specifying tcp/udp ports between 2 hosts to see if that works? That way you can eliminate an ACL issue. I don't recall if PBR increments the ACL counters but you can check that to make sure your traffic is being matched. 

Marco.

[renemerki1]

Hi Marco,

Many thanks for your help. It's fixed now. It helped removing the port's. Then the customer find out that some Firewall Parameters were affecting the PBR functionallity.

These were the Parameters: From Customer:

• Problem Zeilen sind:
  • ip inspect audit-trail
  • ip inspect udp idle-time 1800
  • ip inspect dns-timeout 60
  • ip inspect tcp idle-time 14400
  • ip inspect name out_wan_inspect udp router-traffic
  • ip inspect name out_wan_inspect tcp router-traffic
  • ip inspect name out_wan_inspect ftp timeout 3600
  • ip inspect name out_wan_inspect rcmd timeout 3600
  • ip inspect name out_wan_inspect realaudio timeout 3600
  • ip inspect name out_wan_inspect smtp timeout 3600
  • ip inspect name out_wan_inspect tftp timeout 30
  • ip inspect name out_wan_inspect udp timeout 15
  • ip inspect name out_wan_inspect tcp timeout 3600
• Thanks
• René