Question

A network engineer configures policy-based routing on R2 to forward all HTTP traffic sourced from 10.1.1.0/24 out a backup ISP link. The route-map is applied inbound on the LAN interface and contains: 'match ip address HTTP_ACL' and 'set ip next-hop 203.0.113.5'. The primary default route via 198.51.100.1 remains active. After applying the policy, 'show route-map' shows zero policy matches even though users on 10.1.1.0/24 are actively browsing HTTP sites. The ACL correctly permits tcp any eq 80. What is the most likely reason PBR is not matching the traffic?

Accepted Answer

The ACL matches destination port 80 with 'eq 80' in the source position, so return traffic is matched instead of client requests, which arrive with a random source port and destination port 80

Answer

PBR only processes traffic that would otherwise be dropped, so packets with an existing default route bypass the route-map entirely

Answer

The 'set ip next-hop' address 203.0.113.5 must be directly connected; otherwise PBR silently ignores the route-map with no match counter increment

Answer

Route-maps applied inbound only evaluate routing-protocol updates, not data-plane packets, so 'ip policy route-map' must be used instead