Unable to define a route-map on a 3850 stack.

[Stephen Carville]

I am trying to add a route policy to a VLAN on a 3850 stack but the route-map doesn't seem to be working.

First I defined an access list:

#show access-lists rc-lereta-open
Standard IP access list rc-lereta-open
    10 deny   10.219.57.1
    20 permit 10.219.57.0, wildcard bits 0.0.0.255
    30 deny   any

Then I tried to configure a route-map

(config)# route-map rc-lereta-open permit 10
(config-route-map)# match ip address rc-lereta-open
(config-route-map)# set ip next-hop 192.168.100.42

However, when I check the route-map the set clause is not there.

# show route-map rc-lereta-open
route-map rc-lereta-open, permit, sequence 10
  Match clauses:
    ip address (access-lists): rc-lereta-open
  Set clauses:

This works on all the other 3850 switches and I cannot fathom why it fails here.  The next hop address exists and is reachable.  

[Philip D'Ath]

Which 3850 do you have, and what software version are you running?

[Stephen Carville]

According to show version:

Switch Ports Model              SW Version        SW Image              Mode   
------ ----- -----              ----------        ----------            ----   
     1 56    WS-C3850-48P       03.02.03.SE       cat3k_caa-universalk9 INSTALL
     2 56    WS-C3850-48P       03.02.03.SE       cat3k_caa-universalk9 INSTALL
     3 56    WS-C3850-48P       03.02.03.SE       cat3k_caa-universalk9 INSTALL
     4 56    WS-C3850-48P       03.02.03.SE       cat3k_caa-universalk9 INSTALL
     5 56    WS-C3850-48P       03.02.03.SE       cat3k_caa-universalk9 INSTALL

[Mark Malone · Accepted solution]

Hi

you need to have at least ipbase license and then run sdm prefer advanced for pbr on 3850

[Stephen Carville]

Thank you.

I knew about ipbase but not about sdm.  It will be a few days before I can test since it requires a reload.

[Stephen Carville]

I was finally able to reload the switch stack

It is now using the advanced template

# show sdm prefer
Showing SDM Template Info

This is the Advanced template.
  Number of VLANs:                                 4094
  Unicast MAC addresses:                           32768
  Overflow Unicast MAC addresses:                  512
  IGMP and Multicast groups:                       8192
  Overflow IGMP and Multicast groups:              512
  Directly connected routes:                       32768
  Indirect routes:                                 8192
  Security Access Control Entries:                 3072
  QoS Access Control Entries:                      2816
  Policy Based Routing ACEs:                       1024
  Netflow ACEs:                                    1024
  Input Microflow policer ACEs:                    256
  Output Microflow policer ACEs:                   256
  Flow SPAN ACEs:                                  256
  Tunnels:                                         256
  Control Plane Entries:                           512
  Input Netflow flows:                             8192
  Output Netflow flows:                            16384
These numbers are typical for L2 and IPv4 features.
Some features such as IPv6, use up double the entry size;
so only half as many entries can be created.

I rebuilt the route-map:

# conf t

(config)# route-map rc-lereta-open permit 10

(config-route-map)# match ip address rc-lereta-open

(config-route-map)# set ip next-hop 192.168.100.42

The set clauses still do not appear:

#show route-map
route-map rc-lereta-open, permit, sequence 10
  Match clauses:
    ip address (access-lists): rc-lereta-open
  Set clauses:

The ipbase license is in use:

# show license right-to-use summary
  License Name    Type     Count   Period left
-----------------------------------------------
  ipbase       permanent   N/A      Lifetime
  apcount      base        0        Lifetime
  apcount      adder       25       Lifetime

--------------------------------------------

License Level In Use: ipbase
License Level on Reboot: ipbase
Evaluation AP-Count: Disabled
Total AP Count Licenses: 25
AP Count Licenses In-use: 0
AP Count Licenses Remaining: 25

I did notice that the 3850 stack in Dallas where everything works as expected is at revision 03.06.04.E whereas the switch were it does not work is at 03.02.03.SE.

Do I need to update the OS?

[Philip D'Ath · Accepted solution]

03.02.03 is a bad software version and should not be used in production. I would upgrade to 03.06.04E or 03.07.04E.

[Stephen Carville]

Thank you for your quick response.  I'll let the bosses know the bad news on Monday.

[Stephen Carville]

The upgrade (03.06.04.E) and sdm prefer seems to have fixed it.