Pham,
Here are the guidelines and restrictions from the configuration guide. As you can see I have highlighted that the ACL in your route-map will lead to traffic being punted becuase you have a Deny ACE (deny ip any x.x.x.x). To restrict the traffic from the end user to the proxy specify the source of the traffic
Example:
route-map Internet permit 10
match ip address Acl_Proxy
set ip next-hop 172.18.32.74
Extended IP access list ACL_proxy
10 permit tcp 10.0.0.0 0.255.255.255 any eq www
20 permit tcp 10.0.0.0 0.255.255.255 any eq 443
Before configuring PBR, you should be aware of this information:
•
To use PBR, you must have the IP services image installed on the stack master.
•Multicast traffic is not policy-routed. PBR applies to only to unicast traffic.
•You can enable PBR on a routed port or an SVI.
•The switch does not support route-map deny statements for PBR.
•You can apply a policy route map to an EtherChannel port channel in Layer 3 mode, but you cannot apply a policy route map to a physical interface that is a member of the EtherChannel. If you try to do so, the command is rejected. When a policy route map is applied to a physical interface, that interface cannot become a member of an EtherChannel.
•You can define a maximum of 246 IP policy route maps on the switch stack.
•You can define a maximum of 512 access control entries (ACEs) for PBR on the switch stack.
•When configuring match criteria in a route map, follow these guidelines:
–Do not match ACLs that permit packets destined for a local address. PBR would forward these packets, which could cause ping or Telnet failure or route protocol flapping.
–Do not match ACLs with deny ACEs. Packets that match a deny ACE are sent to the CPU, which could cause high CPU utilization.
•To use PBR, you must first enable the routing template by using the sdm prefer routing global configuration command. PBR is not supported with the VLAN or default template. For more information on the SDM templates, see Chapter 8, "Configuring SDM Templates."
•VRF and PBR are mutually exclusive on a switch interface. You cannot enable VRF when PBR is enabled on an interface. The reverse is also true, you cannot enable PBR when VRF is enabled on an interface.
•Web Cache Communication Protocol (WCCP) and PBR are mutually exclusive on a switch interface. You cannot enable WCCP when PBR is enabled on an interface. The reverse is also true, you cannot enable PBR when WCCP is enabled on an interface.
•The number of TCAM entries used by PBR depends on the route map itself, the ACLs used, and the order of the ACLs and route-map entries.
•Policy-based routing based on packet length, TOS, set interface, set default next hop, or set default interface are not supported. Policy maps with no valid set actions or with set action set to Don't Fragment are not supported.
•The switch supports quality of service (QoS) DSCP and IP precedence matching in PBR route maps, with these limitations:
–You cannot apply QoS DSCP mutation maps and PBR route maps to the same interface.
–You cannot configure DSCP transparency and PBR DSCP route maps on the same switch.
–When you configure PBR with QoS DSCP, you can set QoS to be enabled (by entering the mls qos global configuration command) or disabled (by entering the no mls qos command). When QoS is enabled, to ensure that the DSCP value of the traffic is unchanged, you should configure a DSCP trust state on the port where traffic enters the switch by entering the mls qos trust dscp interface configuration command. If the trust state is not DSCP, by default all nontrusted traffic would have the DSCP value marked as 0.
