You cannot have the same IP subnet (192.168.1.0/24) separated by another subnet or subnets (10.10.10.0/24) as that will not work.    Just change one of the PC subnets to 192.168.2.0/24 and as long as your routing is setup correctly it should work.    Jon ... View more

  Just to clarify as you asked for it to be crystal clear.    You are spot on as to the reason it was not working but be aware there is always a native vlan on the switch, it just didn't match the one you were using on your ESXi host.    Once you changed the native vlan to match your host then it worked but the switch does not then add a tag to the frame, it does not need to, because it knows what vlan the frame is in already and it still would not need to add a tag if it was forwarding it on to another switch providing the same native vlan has been used on all trunk links.    However, as you can if you want, use a different native vlan per trunk, if the switch did need to forward it on to another switch and the native vlan was not the same then it would now need to add a tag to that frame before sending it.    Probably goes without saying but just to be clear I am not suggesting having a different native vlan per trunk is a good idea :)    Jon ... View more

  You can use IP SLA with PBR to check that the end to end connectivity is up.    The key thing is the IP address you use with IP SLA must only be reachable via WAN B ie. it cannot be an IP that is also advertised across WAN A because then it would always be up and your PBR would always use WAN B even if there was an issue.    Jon ... View more

  Just updated link to release notes as I can never work out which is which ie. IOS or IOS XE :)    Both say the same thing though ie. IPBase does not support PBR.    Jon ... View more

  I don't think IPBase supports PBR, from the 4500E IOS 15.1(2)SGx release notes -    The IP Base image supports Open Shortest Path First (OSPF) for Routed Access, Enhanced Interior Gateway Routing Protocol (EIGRP) "limited" Stub Routing, Nonstop Forwarding/Stateful Switchover (NSF/SSO), and RIPv1/v2. The IP Base image does not support enhanced routing features such as BGP, Intermediate System-to-Intermediate System (IS-IS), Internetwork Packet Exchange (IPX), AppleTalk, Virtual Routing Forwarding (VRF-lite), GLBP, and policy-based routing (PBR).   Full link -    https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/release/note/OL_27991-01.html   Jon ... View more

  Just checked switch configuration and can see you are running 4500.    What feature set are you running on that switch ?    Jon ... View more

  You could do although I would argue it is easier to move the L3 interface to be honest because logically it just makes more sense to me ie. you want all traffic to and from vlan 140 to go via the firewall so move it to the firewall.    An alternative solution could be to use VRFs and put that vlan into it's own VRF and have a default route in that VRF pointing to the firewall.    That said you want to use PBR so what is the device ie. model etc. that you are trying to apply the PBR on ?   Jon ... View more

  It looks like you want any traffic to vlan 140 to be routed via the firewall so why not just move the L3 interface for vlan 140 to the firewall.    Note even if you get PBR working the return traffic from vlan 140 would route directly back and not via the firewall which probably isn't what you want.    Jon ... View more

  The default route points to the same next hop IP so why do you need PBR.    As for PBR you need to apply the route map to the SVI eg.    int vlan 140 ip policy route-map To-FW   also in the configuration you posted your route map has no next hop defined although your screenshot does show you applying it.    Jon   ... View more

  Okay, then don't advertise any routes to the ISP and use a route map to deny any inbound routes.    Jon ... View more

  Either don't configure BGP or if you do just leave the neighbor shut down.    Jon ... View more

  Assuming this is a L3 MPLS VPN which it sounds like it is you can't really do the first thing without provider involvement and even then you may not be able to do it.    If all your site routers peered directly with each using BGP then obviously you can use BGP attributes to tell each site which default to use but all your site routers peer with the provider PE devices so you can't do that ie. if you originated a default route at the HQ site how do you tell the provider to only use that route for a specific branch.    Probably the easiest solution would be to use a tunnel across the MPLS network between the branch and the HQ site and then you could peer directly as well as to the PE router from the branch although that assumes a different AS number at the branch.   As for the second thing of using HQ for all internet and DC as backup yes that is exactly what you can do and that will work without any provider involvement and yes you could use IP SLA to monitor your internet links to remove the default route advertisement if needed.    Jon      ... View more