300-410 Policy-Based Routing (PBR) Practice Questions

Question 1

A network engineer is troubleshooting a PBR configuration on a Cisco router. The engineer has configured a route map named 'PBR-MAP' with a match statement matching traffic from source IP 10.1.1.0/24 and a set statement to forward the traffic to next-hop 192.168.1.2. The engineer applies the route map to the incoming interface GigabitEthernet0/0 using 'ip policy route-map PBR-MAP'. However, traffic from 10.1.1.0/24 is still being forwarded using the routing table instead of the PBR next-hop. What is the most likely cause?

Accepted Answer

The route map is applied to the outgoing interface instead of the incoming interface.. The 'ip policy route-map' command must be applied to the incoming interface where the traffic is received. If it is applied to the outgoing interface, PBR will not function. The symptom indicates the route map is not being evaluated, which typically occurs when the policy is applied to the wrong interface or not applied at all.

Answer

The 'set ip next-hop' command requires the 'verify-availability' keyword to activate PBR.

Answer

The route map sequence number is missing; PBR requires sequence numbers to be explicitly defined.

Answer

The 'ip policy route-map' command must be applied globally under 'ip route-cache policy'.

Question 2

A network engineer is troubleshooting PBR on a Cisco router where traffic from VLAN 100 (192.168.10.0/24) should be forwarded to next-hop 10.10.10.2 via a route map named 'VLAN100-PBR'. The engineer has applied the route map to interface GigabitEthernet0/0.100 (subinterface) using 'ip policy route-map VLAN100-PBR'. The engineer verifies that the route map is correctly configured with 'match ip address 100' and 'set ip next-hop 10.10.10.2', and the access list 100 matches the source subnet. However, traffic from VLAN 100 is still forwarded using the routing table. What is the most likely cause?

Accepted Answer

The traffic is arriving on the physical interface GigabitEthernet0/0 instead of the subinterface GigabitEthernet0/0.100.. PBR applied to a subinterface will only process traffic that arrives on that specific subinterface. If the traffic is arriving on the physical interface or another subinterface, it will not be matched. The engineer must ensure the traffic actually enters the subinterface where the policy is applied.

Answer

The access list 100 is missing the 'permit' keyword; PBR only processes permit statements.

Answer

The 'set ip next-hop' command must be followed by 'force' to override the routing table.

Answer

The route map must be applied to the VLAN interface (SVI) instead of the subinterface.

Question 3

A network engineer is troubleshooting PBR on a Cisco router where traffic from source 10.1.2.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-TEST' is configured with 'match ip address 101' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for most traffic, but traffic from a specific host (10.1.2.100) is not being policy-routed. The engineer checks the ACL 101 and confirms it includes 10.1.2.0/24. What is the most likely cause?

Accepted Answer

The router is using CEF switching, and PBR is not applied to CEF-switched traffic without the 'ip route-cache policy' command.. If PBR is working for most traffic but not for a specific host, it could be due to the route map being applied to a subinterface while the host traffic arrives on a different subinterface, or the host traffic is being fast-switched and bypassing PBR. However, a common cause is that the host's traffic is being processed by CEF and the 'ip policy route-map' command does not affect CEF-switched packets unless 'ip route-cache policy' is enabled. In modern IOS, PBR by default only applies to process-switched packets unless 'ip route-cache policy' is configured.

Answer

The host 10.1.2.100 is sending traffic with a different source IP than expected.

Answer

The 'set ip next-hop' command requires the next-hop to be directly connected, and 192.168.1.2 is not reachable.

Answer

The route map is missing a 'sequence 10' statement; PBR requires explicit sequence numbers.

Question 4

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 172.16.1.0/24 should be forwarded to next-hop 10.10.10.2. The route map 'PBR-172' is applied to interface GigabitEthernet0/0. The engineer notices that the PBR policy is not working at all. The engineer checks the route map configuration and sees 'match ip address 110' and 'set ip next-hop 10.10.10.2'. The engineer also checks the ACL 110 and confirms it matches 172.16.1.0/24. The engineer then checks the interface configuration and sees 'ip policy route-map PBR-172' applied. What should the engineer do next to isolate the issue?

Accepted Answer

Check if the next-hop 10.10.10.2 is reachable via the routing table.. The engineer should verify that the next-hop 10.10.10.2 is reachable via a directly connected interface or a static route. PBR will not forward traffic to a next-hop that is not in the routing table or not directly connected, and will fall back to the routing table. The engineer can use 'show ip route 10.10.10.2' to check reachability.

Answer

Add the 'set ip default next-hop' command to the route map.

Answer

Change the route map to use 'set interface' instead of 'set ip next-hop'.

Answer

Apply the route map to the outgoing interface instead of the incoming interface.

Question 5

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 192.168.20.0/24 should be forwarded to next-hop 10.20.20.2. The route map 'PBR-20' is configured with 'match ip address 120' and 'set ip next-hop 10.20.20.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 192.168.20.0/24, but traffic from other subnets is also being forwarded to 10.20.20.2. What is the most likely cause?

Accepted Answer

The route map has a permit statement with no match condition, causing all traffic to be policy-routed.. If PBR is affecting traffic from other subnets, it is likely because the route map has a permit statement without a match condition, or the ACL is misconfigured to match all traffic. The engineer should check the route map for a permit statement that matches all traffic (e.g., 'match ip address any' or missing match).

Answer

The 'set ip next-hop' command is applied globally under the routing process.

Answer

The route map is applied to the wrong interface, but the interface is receiving traffic from all subnets.

Question 6

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.10.10.0/24 should be forwarded to next-hop 192.168.100.2. The route map 'PBR-10' is configured with 'match ip address 130' and 'set ip next-hop 192.168.100.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is dropping packets instead of forwarding them. The engineer checks the ACL 130 and confirms it matches 10.10.10.0/24. What is the most likely cause?

Accepted Answer

The route map has a deny statement that matches the traffic, causing packets to be dropped.. If PBR is dropping packets, it could be because the next-hop is unreachable and the route map has a 'set ip next-hop' command that fails, causing the router to drop the packet if no fallback is configured. However, by default, if the next-hop is unreachable, the router should use the routing table. But if the route map has a 'set ip next-hop' with 'verify-availability' and the next-hop is down, the router may drop the packet. Another possibility is that the route map has a 'deny' statement that drops traffic. The most likely cause is that the route map has a 'deny' statement that matches the traffic, causing it to be dropped.

Answer

The next-hop 192.168.100.2 is unreachable, and PBR drops packets when the next-hop is down.

Answer

The 'ip policy route-map' command is applied to the wrong interface, and the router is dropping packets due to ACL filtering.

Answer

The ACL 130 is missing the 'permit' keyword, causing all traffic to be denied.

Question 7

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 172.16.0.0/16 should be forwarded to next-hop 10.10.10.2. The route map 'PBR-172' is configured with 'match ip address 140' and 'set ip next-hop 10.10.10.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 172.16.1.0/24 but not for traffic from 172.16.2.0/24. The engineer checks the ACL 140 and confirms it includes the entire 172.16.0.0/16 subnet. What is the most likely cause?

Accepted Answer

The route map has a sequence that matches 172.16.1.0/24 with a permit, and a later sequence that denies 172.16.2.0/24.. If PBR works for one subnet but not another within the same ACL, it could be due to the route map having multiple sequence statements with different match conditions, or the ACL having specific permit statements that are ordered incorrectly. However, a common cause is that the route map has a sequence with a more specific match that matches 172.16.1.0/24 and a subsequent sequence that denies 172.16.2.0/24. The engineer should check the route map sequence numbers and the ACL order.

Answer

The next-hop 10.10.10.2 is not reachable from the 172.16.2.0/24 subnet.

Answer

The 'ip policy route-map' command is applied to a subinterface that only receives traffic from 172.16.1.0/24.

Question 8

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.1.1.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-10' is configured with 'match ip address 150' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is using the routing table to forward traffic. The engineer checks the ACL 150 and confirms it matches 10.1.1.0/24. The engineer also checks the interface configuration and sees 'ip policy route-map PBR-10' applied. What is the most likely cause?

Accepted Answer

The ACL 150 does not exist or is misconfigured, causing the route map to not match any traffic.. If PBR is not working and the router uses the routing table, it could be because the route map is not being processed due to a missing 'match' statement or the route map being empty. However, a common cause is that the route map has a 'match ip address' that references an ACL that does not exist or is misconfigured. The engineer should verify that the ACL 150 exists and is correctly configured.

Answer

The 'set ip next-hop' command is misspelled as 'set ip nexthop'.

Answer

The router is running an older IOS version that does not support PBR.

Answer

The 'ip policy route-map' command is applied to the outgoing interface instead of the incoming interface.

Question 9

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 192.168.50.0/24 should be forwarded to next-hop 10.50.50.2. The route map 'PBR-50' is configured with 'match ip address 160' and 'set ip next-hop 10.50.50.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 192.168.50.0/24, but the router is also policy-routing traffic from other subnets that should not be affected. The engineer checks the ACL 160 and confirms it only matches 192.168.50.0/24. What is the most likely cause?

Accepted Answer

The route map has a sequence with no match condition, which matches all traffic.. If PBR is affecting traffic from other subnets despite the ACL being correct, it could be because the route map has a permit statement without a match condition, or the route map is applied to multiple interfaces. However, a common cause is that the route map has a 'match ip address' that references an ACL with a 'permit ip any any' statement at the end, or the route map has a sequence that matches all traffic. The engineer should check the route map for any sequence that does not have a match statement.

Answer

The 'ip policy route-map' command is applied to multiple interfaces, and traffic from other subnets is entering those interfaces.

Answer

The router is using CEF switching, and PBR is applied to all traffic regardless of ACL.

Question 10

A network engineer runs the following command on Router R1:

R1# show route-map
route-map PBR-ROUTE, permit, sequence 10
  Match clauses:
    ip address (access-lists): ACL-PBR
  Set clauses:
    ip next-hop 192.168.1.2
  Policy routing matches: 0 packets, 0 bytes

route-map PBR-ROUTE, permit, sequence 20
  Match clauses:
  Set clauses:
    ip next-hop 192.168.2.2
  Policy routing matches: 0 packets, 0 bytes

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-ROUTE

Based on this output, what is the most likely problem?

Accepted Answer

The access list ACL-PBR does not exist or matches no traffic.. The show route-map output shows zero policy routing matches. The route map is applied to the interface, but the access list ACL-PBR may not match any traffic, or traffic is not arriving on GigabitEthernet0/0. The set clause in sequence 20 is applied unconditionally (no match clause), which would normally match all traffic, but sequence 10 must be evaluated first; if ACL-PBR matches nothing, sequence 20 would match all, yet counters still show zero, indicating no traffic is being policy-routed at all.

Answer

The route map is not applied to an interface.

Answer

The next-hop 192.168.1.2 is unreachable.

Answer

The route map is missing a permit statement.

Policy-Based Routing (PBR)

300-410 Policy-Based Routing (PBR) — Practice Questions

In Policy-Based Routing (PBR), what is the default action for packets that do not match any route-map sequence?

Which of the following is a valid 'set' action in a PBR route-map?

When using 'set ip next-hop verify-availability', what mechanism does the router use to determine if the next-hop is reachable?

Which TWO commands would a network engineer use to verify the operation of Policy-Based Routing (PBR) on a Cisco IOS router? (Choose TWO.)

Which TWO statements about Policy-Based Routing (PBR) are true? (Choose TWO.)

Which TWO configuration steps are required to implement Policy-Based Routing (PBR) on a Cisco router? (Choose TWO.)

All 300-410 Objectives