Hi Richard,   Thank you for your response.   Actually, the client is located inside on VLAN 200 and accessing the Internet, and if a PBR is working well should be routed on ISP 2. Some clients on guest WiFi (VLAN 200) are using mobile phones with VPN enabled on them (commercial VPN) to bypass the firewall. Our Firewall for guest network have policies to block some websites and applications but we cannot control the users from using their own VPN enabled mobile device to access blocked websites and applications.   If you said,     So it does not matter what address the vpn client is using. If the packet has source address of 192.168.200 then PBR is going to process it. If you did not want PBR to process packets from vpn client then you would need to alter access list 100 to deny packets with destination address used by vpn client before it does the permit any.     I'm assuming that the PBR doesn't work well because the network traffic on the ISP 1 is been affected with the heavy traffic from guest users. If i look at our bandwidth utilization on ISP 1, it is reaching the maximum and the weird thing is why the inside interface of the Firewall 1 have high throughput and it gives a warning to our ISP 1 that we are reaching 80-90% bandwidth utilization. Why the inside zone of the firewall 1 is giving warning to the ISP? It should be the outside zone which is the interface connecting to ISP.   INSIDE ZONE THROUGHPUT   INSIDE ZONE THROUGPUT     During the heavy traffic, if i check the wireless controller to see what's going on, i can see some users on guest WiFi network are utilizing high bandwidth usage. If i disable this users on the WC, i observe that the bandwidth utilization on ISP 1 decreases but on ISP 2 is not affected.    My question is, why the ISP 1 is affected with heavy bandwidth usage of users in Guest network? And why the inside zone of firewall 1 high throughput is affecting the ISP 1?    Need your advise.   Thank you.       ... View more

Hello Richard,   I have a quick question.   If someone is using VPN client, does the PBR still work?  We know that VPN clients will changed their source IP address and how the switch behave in this case?   Thanks and regards, ... View more

Hi Richard,   After checking on the users traffic, i can see PBR is working fine now. And also checking on users browser and typing "What's my IP address"it will show the Public IP of the ISP2 so it means internet request from VLAN 200 is routed on the correct ISP.     Removing the  parameters for verify-availability and for track from the route map resolved my issue.   This is the working configuration:     ! ip sla 5 icmp-echo 10.11.1.2 source-ip 10.11.1.1 ip sla schedule 5 life forever start-time now access-list 100 permit ip 192.168.200.0 0.0.0.255 any ! route-map PBR permit 10 match ip address 100 set ip next-hop 10.11.1.2 ! interface Vlan200 ip address 192.168.200.1 255.255.255.0 ip nat inside ip policy route-map PBR     Thanks a lot for your help.   ... View more

Hi Paul,   See below output    ... View more

Hi Richard,   Switch version is 03.06.06E.  After removing the line set ip next-hop verify-availability 10.11.1.2 1 track 10 under route-map PBR the policy is applied on int vlan 200. I will test tomorrow in the site when users are connected on that VLAN. I am currently accessing the switch remotely and no users are active yet. I'll let you know. Thanks!!   ... View more

Hi Richard, That's my issue now. I have applied the policy route-map on the int vlan 200 but it's not taking. Doing sh run int vlan 200 will not show the policy being applied.   ... View more

Hi Richard, Thank you for the additional information.   The PBR is not applying on int vlan 200. What i need to check?   C3850-Core-SW#sh run interface vlan 200 Building configuration... Current configuration : 80 bytes ! interface Vlan200 ip address 192.168.200.1 255.255.255.0 ip nat inside end C3850-Core-SW# ... View more

Hi Paul, I can ping the source from int VLAN 200: C3850-Core-SW#ping Protocol [ip]: Target IP address: 192.168.200.48 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: y Source address or interface: 192.168.200.1 Type of service [0]: Set DF bit in IP header? [no]: Validate reply data? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.200.48, timeout is 2 seconds: Packet sent with a source address of 192.168.200.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/6/10 ms C3850-Core-SW# NAT is not enabled on switch. I tried the commands but still same result. ... View more

Hi Paul,   I can ping the next hop 10.11.1.2 from Core switch.   C3850-Core-SW#ping 10.11.1.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.11.1.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms C3850-Core-SW#   Also I have this configuration PBR route-map to VLAN 200:   ip sla 5 icmp-echo 10.11.1.2 source-ip 10.11.1.1 ip sla schedule 5 life forever start-time now access-list 100 permit ip 192.168.200.0 0.0.0.255 any ! route-map PBR permit 10 match ip address 100 set ip next-hop verify-availability 10.11.1.2 1 track 10 ! interface vlan 200 ip policy route-map PBR         ... View more

Hi Paul, Why the traceroute results shows like this?   C3850-Core-SW#tRaceroute Protocol [ip]: Target IP address: 8.8.8.8 Source address: 192.168.200.1 Numeric display [n]: Timeout in seconds [3]: Probe count [3]: Minimum Time to Live [1]: Maximum Time to Live [30]: Port Number [33434]: Loose, Strict, Record, Timestamp, Verbose[none]: Type escape sequence to abort. Tracing the route to 8.8.8.8 VRF info: (vrf in name/id, vrf out name/id) 1 * * * 2 * * * 3 * * * 4 * * * 5 * * * 6 * * * 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * 16 * * * 17 * * * 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * C3850-Core-SW#           For the access-list:   C3850-Core-SW#sh access-lists Extended IP access list 100 10 permit ip 192.168.200.0 0.0.0.255 any Extended IP access list CISCO-CWA-URL-REDIRECT-ACL 100 deny udp any any eq domain 101 deny tcp any any eq domain 102 deny udp any eq bootps any 103 deny udp any any eq bootpc 104 deny udp any eq bootpc any 105 permit tcp any any eq www Extended IP access list preauth_ipv4_acl (per-user) 10 permit udp any any eq domain 20 permit tcp any any eq domain 30 permit udp any eq bootps any 40 permit udp any any eq bootpc 50 permit udp any eq bootpc any 60 deny ip any any IPv6 access list preauth_ipv6_acl (per-user) permit udp any any eq domain sequence 10 permit tcp any any eq domain sequence 20 permit icmp any any nd-ns sequence 30 permit icmp any any nd-na sequence 40 permit icmp any any router-solicitation sequence 50 permit icmp any any router-advertisement sequence 60 permit icmp any any redirect sequence 70 permit udp any eq 547 any eq 546 sequence 80 permit udp any eq 546 any eq 547 sequence 90 deny ipv6 any any sequence 100 C3850-Core-SW# ... View more

Thanks Georg. Some users are on VLAN 200 and accessing the internet and I check with the commands but it showing no packets:   C3850-Core-SW#show route-map route-map PBR, permit, sequence 10 Match clauses: ip address (access-lists): 100 Set clauses: ip next-hop verify-availability 10.11.1.2 1 track 10 [up] Policy routing matches: 0 packets, 0 bytes   By the way, i have a static route to ISP 1 0.0.0.0 0.0.0.0 10.10.1.2   Thanks. ... View more

Hi Paul, Thank you for helping and the commands provided. I tried the commands and how can I verify on the core switch that the internet traffic from VLAN 200 is going to my ISP 2?   Thank you.     ... View more

Hi Marvin,   Running the scp command preceeded by "sudo" made the file transfer successful. I can now proceed with the upgrade process.   Thank you for your help.   ... View more