cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
373
Views
1
Helpful
5
Replies

Policy Based Routing Not routing out configured egress interface FTD

Danny Dulin
Level 1
Level 1

I have setup a Route Based Site-Site Tunnel with Cisco Umbrella. Tunnel comes up fine. My issue is I'm using Policy Based Routing because I only want 80/443 traffic to go over the tunnel. 


Packet tracer shows that PBR-Lookup matches the ACL and identifies the VTI, but the FTD doesn't resolve the egress to the VTI...but to the outside interface.

So the traffic isn't flowing over the tunnel to Umbrella, which is confusing since it is matching the ACL used by the PBR.

 

DannyDulin_2-1731098130405.png

 

show route-map
route-map FMC_GENERATED_PBR_1730396602092, permit, sequence 5
Match clauses:
ip address (access-lists): Umbrella_Tunnel_Allow_Mailroom

Set clauses:
adaptive-interface cost Umbrella-VTI (0)

DannyDulin_1-1731096894864.png

 

 

 




5 Replies 5

Thank you. Used this and followed the instructions to the letter. Still, the traffic in ACL not being sent to VTI interface.

balaji.bandi
Hall of Fame
Hall of Fame

I am sure you have all routing in place verify and check the below configuration guide :

https://support.umbrella.com/hc/en-us/articles/15671337422996-Guide-to-FTD-Application-Based-PBR-for-Umbrella-SIG

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

AViftrup
Level 1
Level 1

Set clauses:
adaptive-interface cost Umbrella-VTI (0)

Set your clause / next-hop to be +1 of your own VTI address towards Umbrella.

Not sure what you mean.