300-410 Policy-Based Routing (PBR) — 30 Questions

Question 1

A network engineer is troubleshooting a PBR configuration on a Cisco router. The engineer has configured a route map named 'PBR-MAP' with a match statement matching traffic from source IP 10.1.1.0/24 and a set statement to forward the traffic to next-hop 192.168.1.2. The engineer applies the route map to the incoming interface GigabitEthernet0/0 using 'ip policy route-map PBR-MAP'. However, traffic from 10.1.1.0/24 is still being forwarded using the routing table instead of the PBR next-hop. What is the most likely cause?

Accepted Answer

The route map is applied to the outgoing interface instead of the incoming interface.. The 'ip policy route-map' command must be applied to the incoming interface where the traffic is received. If it is applied to the outgoing interface, PBR will not function. The symptom indicates the route map is not being evaluated, which typically occurs when the policy is applied to the wrong interface or not applied at all.

Answer

The 'set ip next-hop' command requires the 'verify-availability' keyword to activate PBR.

Answer

The route map sequence number is missing; PBR requires sequence numbers to be explicitly defined.

Answer

The 'ip policy route-map' command must be applied globally under 'ip route-cache policy'.

Question 2

A network engineer is troubleshooting PBR on a Cisco router where traffic from VLAN 100 (192.168.10.0/24) should be forwarded to next-hop 10.10.10.2 via a route map named 'VLAN100-PBR'. The engineer has applied the route map to interface GigabitEthernet0/0.100 (subinterface) using 'ip policy route-map VLAN100-PBR'. The engineer verifies that the route map is correctly configured with 'match ip address 100' and 'set ip next-hop 10.10.10.2', and the access list 100 matches the source subnet. However, traffic from VLAN 100 is still forwarded using the routing table. What is the most likely cause?

Accepted Answer

The traffic is arriving on the physical interface GigabitEthernet0/0 instead of the subinterface GigabitEthernet0/0.100.. PBR applied to a subinterface will only process traffic that arrives on that specific subinterface. If the traffic is arriving on the physical interface or another subinterface, it will not be matched. The engineer must ensure the traffic actually enters the subinterface where the policy is applied.

Answer

The access list 100 is missing the 'permit' keyword; PBR only processes permit statements.

Answer

The 'set ip next-hop' command must be followed by 'force' to override the routing table.

Answer

The route map must be applied to the VLAN interface (SVI) instead of the subinterface.

Question 3

A network engineer is troubleshooting PBR on a Cisco router where traffic from source 10.1.2.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-TEST' is configured with 'match ip address 101' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for most traffic, but traffic from a specific host (10.1.2.100) is not being policy-routed. The engineer checks the ACL 101 and confirms it includes 10.1.2.0/24. What is the most likely cause?

Accepted Answer

The router is using CEF switching, and PBR is not applied to CEF-switched traffic without the 'ip route-cache policy' command.. If PBR is working for most traffic but not for a specific host, it could be due to the route map being applied to a subinterface while the host traffic arrives on a different subinterface, or the host traffic is being fast-switched and bypassing PBR. However, a common cause is that the host's traffic is being processed by CEF and the 'ip policy route-map' command does not affect CEF-switched packets unless 'ip route-cache policy' is enabled. In modern IOS, PBR by default only applies to process-switched packets unless 'ip route-cache policy' is configured.

Answer

The host 10.1.2.100 is sending traffic with a different source IP than expected.

Answer

The 'set ip next-hop' command requires the next-hop to be directly connected, and 192.168.1.2 is not reachable.

Answer

The route map is missing a 'sequence 10' statement; PBR requires explicit sequence numbers.

Question 4

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 172.16.1.0/24 should be forwarded to next-hop 10.10.10.2. The route map 'PBR-172' is applied to interface GigabitEthernet0/0. The engineer notices that the PBR policy is not working at all. The engineer checks the route map configuration and sees 'match ip address 110' and 'set ip next-hop 10.10.10.2'. The engineer also checks the ACL 110 and confirms it matches 172.16.1.0/24. The engineer then checks the interface configuration and sees 'ip policy route-map PBR-172' applied. What should the engineer do next to isolate the issue?

Accepted Answer

Check if the next-hop 10.10.10.2 is reachable via the routing table.. The engineer should verify that the next-hop 10.10.10.2 is reachable via a directly connected interface or a static route. PBR will not forward traffic to a next-hop that is not in the routing table or not directly connected, and will fall back to the routing table. The engineer can use 'show ip route 10.10.10.2' to check reachability.

Answer

Add the 'set ip default next-hop' command to the route map.

Answer

Change the route map to use 'set interface' instead of 'set ip next-hop'.

Answer

Apply the route map to the outgoing interface instead of the incoming interface.

Question 5

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 192.168.20.0/24 should be forwarded to next-hop 10.20.20.2. The route map 'PBR-20' is configured with 'match ip address 120' and 'set ip next-hop 10.20.20.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 192.168.20.0/24, but traffic from other subnets is also being forwarded to 10.20.20.2. What is the most likely cause?

Accepted Answer

The route map has a permit statement with no match condition, causing all traffic to be policy-routed.. If PBR is affecting traffic from other subnets, it is likely because the route map has a permit statement without a match condition, or the ACL is misconfigured to match all traffic. The engineer should check the route map for a permit statement that matches all traffic (e.g., 'match ip address any' or missing match).

Answer

The 'set ip next-hop' command is applied globally under the routing process.

Answer

The route map is applied to the wrong interface, but the interface is receiving traffic from all subnets.

Question 6

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.10.10.0/24 should be forwarded to next-hop 192.168.100.2. The route map 'PBR-10' is configured with 'match ip address 130' and 'set ip next-hop 192.168.100.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is dropping packets instead of forwarding them. The engineer checks the ACL 130 and confirms it matches 10.10.10.0/24. What is the most likely cause?

Accepted Answer

The route map has a deny statement that matches the traffic, causing packets to be dropped.. If PBR is dropping packets, it could be because the next-hop is unreachable and the route map has a 'set ip next-hop' command that fails, causing the router to drop the packet if no fallback is configured. However, by default, if the next-hop is unreachable, the router should use the routing table. But if the route map has a 'set ip next-hop' with 'verify-availability' and the next-hop is down, the router may drop the packet. Another possibility is that the route map has a 'deny' statement that drops traffic. The most likely cause is that the route map has a 'deny' statement that matches the traffic, causing it to be dropped.

Answer

The next-hop 192.168.100.2 is unreachable, and PBR drops packets when the next-hop is down.

Answer

The 'ip policy route-map' command is applied to the wrong interface, and the router is dropping packets due to ACL filtering.

Answer

The ACL 130 is missing the 'permit' keyword, causing all traffic to be denied.

Question 7

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 172.16.0.0/16 should be forwarded to next-hop 10.10.10.2. The route map 'PBR-172' is configured with 'match ip address 140' and 'set ip next-hop 10.10.10.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 172.16.1.0/24 but not for traffic from 172.16.2.0/24. The engineer checks the ACL 140 and confirms it includes the entire 172.16.0.0/16 subnet. What is the most likely cause?

Accepted Answer

The route map has a sequence that matches 172.16.1.0/24 with a permit, and a later sequence that denies 172.16.2.0/24.. If PBR works for one subnet but not another within the same ACL, it could be due to the route map having multiple sequence statements with different match conditions, or the ACL having specific permit statements that are ordered incorrectly. However, a common cause is that the route map has a sequence with a more specific match that matches 172.16.1.0/24 and a subsequent sequence that denies 172.16.2.0/24. The engineer should check the route map sequence numbers and the ACL order.

Answer

The next-hop 10.10.10.2 is not reachable from the 172.16.2.0/24 subnet.

Answer

The 'ip policy route-map' command is applied to a subinterface that only receives traffic from 172.16.1.0/24.

Question 8

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 10.1.1.0/24 should be forwarded to next-hop 192.168.1.2. The route map 'PBR-10' is configured with 'match ip address 150' and 'set ip next-hop 192.168.1.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR is not working, and the router is using the routing table to forward traffic. The engineer checks the ACL 150 and confirms it matches 10.1.1.0/24. The engineer also checks the interface configuration and sees 'ip policy route-map PBR-10' applied. What is the most likely cause?

Accepted Answer

The ACL 150 does not exist or is misconfigured, causing the route map to not match any traffic.. If PBR is not working and the router uses the routing table, it could be because the route map is not being processed due to a missing 'match' statement or the route map being empty. However, a common cause is that the route map has a 'match ip address' that references an ACL that does not exist or is misconfigured. The engineer should verify that the ACL 150 exists and is correctly configured.

Answer

The 'set ip next-hop' command is misspelled as 'set ip nexthop'.

Answer

The router is running an older IOS version that does not support PBR.

Answer

The 'ip policy route-map' command is applied to the outgoing interface instead of the incoming interface.

Question 9

A network engineer is troubleshooting PBR on a Cisco router where traffic from subnet 192.168.50.0/24 should be forwarded to next-hop 10.50.50.2. The route map 'PBR-50' is configured with 'match ip address 160' and 'set ip next-hop 10.50.50.2'. The engineer applies the route map to interface GigabitEthernet0/0. The engineer notices that PBR works for traffic from 192.168.50.0/24, but the router is also policy-routing traffic from other subnets that should not be affected. The engineer checks the ACL 160 and confirms it only matches 192.168.50.0/24. What is the most likely cause?

Accepted Answer

The route map has a sequence with no match condition, which matches all traffic.. If PBR is affecting traffic from other subnets despite the ACL being correct, it could be because the route map has a permit statement without a match condition, or the route map is applied to multiple interfaces. However, a common cause is that the route map has a 'match ip address' that references an ACL with a 'permit ip any any' statement at the end, or the route map has a sequence that matches all traffic. The engineer should check the route map for any sequence that does not have a match statement.

Answer

The 'ip policy route-map' command is applied to multiple interfaces, and traffic from other subnets is entering those interfaces.

Answer

The router is using CEF switching, and PBR is applied to all traffic regardless of ACL.

Question 10

A network engineer runs the following command on Router R1:

R1# show route-map
route-map PBR-ROUTE, permit, sequence 10
  Match clauses:
    ip address (access-lists): ACL-PBR
  Set clauses:
    ip next-hop 192.168.1.2
  Policy routing matches: 0 packets, 0 bytes

route-map PBR-ROUTE, permit, sequence 20
  Match clauses:
  Set clauses:
    ip next-hop 192.168.2.2
  Policy routing matches: 0 packets, 0 bytes

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-ROUTE

Based on this output, what is the most likely problem?

Accepted Answer

The access list ACL-PBR does not exist or matches no traffic.. The show route-map output shows zero policy routing matches. The route map is applied to the interface, but the access list ACL-PBR may not match any traffic, or traffic is not arriving on GigabitEthernet0/0. The set clause in sequence 20 is applied unconditionally (no match clause), which would normally match all traffic, but sequence 10 must be evaluated first; if ACL-PBR matches nothing, sequence 20 would match all, yet counters still show zero, indicating no traffic is being policy-routed at all.

Answer

The route map is not applied to an interface.

Answer

The next-hop 192.168.1.2 is unreachable.

Answer

The route map is missing a permit statement.

Question 11

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/1      PBR-MAP

R1# show route-map PBR-MAP
route-map PBR-MAP, permit, sequence 10
  Match clauses:
    ip address (access-lists): 101
  Set clauses:
    ip next-hop verify-availability 10.1.1.2 10 track 1
  Policy routing matches: 150 packets, 12000 bytes

R1# show track 1
Track 1
  IP SLA 1 reachability
  Reachability is Down
    1 change, last change 00:05:20
  Latest operation return code: timeout
  Tracked by:
    ROUTE-MAP 0

Based on this output, what is the most likely outcome?

Accepted Answer

Packets matching ACL 101 are routed normally via the routing table.. The route map uses 'ip next-hop verify-availability' with tracking. Track 1 is down because IP SLA 1 reports unreachability. Therefore, the set clause will not be applied, and packets matching ACL 101 will not be forwarded to 10.1.1.2; they will be routed normally via the routing table.

Answer

Packets matching ACL 101 are forwarded to 10.1.1.2 regardless.

Answer

Packets matching ACL 101 are dropped.

Answer

The route map is removed from the interface due to the track failure.

Question 12

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-TEST

R1# show route-map PBR-TEST
route-map PBR-TEST, permit, sequence 10
  Match clauses:
    ip address (access-lists): 110
  Set clauses:
    ip next-hop 192.168.100.1
  Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 110
Extended IP access list 110
    10 permit tcp 10.0.0.0 0.255.255.255 any eq 80
    20 permit tcp 10.0.0.0 0.255.255.255 any eq 443

R1# show ip route 192.168.100.1
Routing entry for 192.168.100.1/32
  Known via "ospf 1", distance 110, metric 20
  Last update from 10.1.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely reason for zero policy routing matches?

Accepted Answer

The access list 110 is not matching any traffic arriving on GigabitEthernet0/0.. The access list 110 matches TCP traffic from 10.0.0.0/8 to any destination on ports 80 and 443. The route map is applied to GigabitEthernet0/0, but traffic arriving on that interface may not match these conditions. The next-hop is reachable, so the issue is likely that no traffic matching ACL 110 is entering GigabitEthernet0/0.

Answer

The next-hop 192.168.100.1 is not reachable.

Answer

The route map sequence number is too high.

Answer

The route map needs to be applied globally.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-QOS

R1# show route-map PBR-QOS
route-map PBR-QOS, permit, sequence 10
  Match clauses:
    ip address (access-lists): 120
  Set clauses:
    ip next-hop 10.0.0.2
  Policy routing matches: 500 packets, 45000 bytes

R1# show access-lists 120
Extended IP access list 120
    10 permit ip 192.168.1.0 0.0.0.255 any

R1# debug ip policy
Policy routing debugging is on
*Mar  1 00:05:23.123: IP: s=192.168.1.100 (GigabitEthernet0/0), d=8.8.8.8, len 100, policy match
*Mar  1 00:05:23.123: IP: s=192.168.1.100 (GigabitEthernet0/0), d=8.8.8.8, len 100, policy rejected

Based on this output, what is the most likely problem?

Accepted Answer

The next-hop 10.0.0.2 is unreachable.. The debug output shows 'policy match' followed by 'policy rejected'. This indicates that the packet matched the route map, but the set clause was not applied because the next-hop is unreachable or the route map's set condition fails (e.g., verify-availability if used, or next-hop not in routing table). The show route-map shows matches, but the packet is rejected and forwarded normally.

Answer

The access list 120 is misconfigured.

Answer

The route map is applied to the wrong interface.

Answer

The route map sequence number is incorrect.

Question 14

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-VOICE

R1# show route-map PBR-VOICE
route-map PBR-VOICE, permit, sequence 10
  Match clauses:
    ip address (access-lists): 130
  Set clauses:
    ip next-hop 192.168.10.1
  Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 130
Extended IP access list 130
    10 permit udp any any range 16384 32767

R1# show interfaces GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet address is 10.1.1.1/24

R1# show ip route 192.168.10.1
% Network not in routing table

Based on this output, what is the most likely problem?

Accepted Answer

The next-hop 192.168.10.1 is not reachable.. The next-hop 192.168.10.1 is not in the routing table. For PBR to forward packets to a next-hop, that next-hop must be reachable (in the routing table). If it is not, packets that match the route map are forwarded using the normal routing table instead. The zero matches could be because no traffic matching ACL 130 has arrived, or because the next-hop is missing, but the missing route is a clear issue.

Answer

The access list 130 is not matching any traffic.

Answer

The interface GigabitEthernet0/0 is down.

Answer

The route map is missing a permit statement.

Question 15

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-MULTI

R1# show route-map PBR-MULTI
route-map PBR-MULTI, permit, sequence 10
  Match clauses:
    ip address (access-lists): 140
  Set clauses:
    ip next-hop 10.0.0.2 10.0.0.3
  Policy routing matches: 200 packets, 18000 bytes

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "eigrp 1", distance 90, metric 28160
  Last update from 192.168.1.2 on GigabitEthernet0/1

R1# show ip route 10.0.0.3
% Network not in routing table

Based on this output, what is the most likely behavior for packets matching ACL 140?

Accepted Answer

Packets are forwarded to 10.0.0.2.. When multiple next-hops are specified in a set clause, PBR tries them in order. The first reachable next-hop is used. Here, 10.0.0.2 is reachable, so packets are forwarded to 10.0.0.2. The second next-hop is not reachable, but that does not affect the first.

Answer

Packets are load-balanced between 10.0.0.2 and 10.0.0.3.

Answer

Packets are dropped because one next-hop is unreachable.

Answer

Packets are forwarded to 10.0.0.3 via a recursive lookup.

Question 16

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-DEFAULT

R1# show route-map PBR-DEFAULT
route-map PBR-DEFAULT, permit, sequence 10
  Match clauses:
    ip address (access-lists): 150
  Set clauses:
    ip next-hop 10.0.0.2
  Policy routing matches: 0 packets, 0 bytes

route-map PBR-DEFAULT, deny, sequence 20
  Match clauses:
  Set clauses:
  Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 150
Extended IP access list 150
    10 permit ip 192.168.1.0 0.0.0.255 any

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "ospf 1", distance 110, metric 20
  Last update from 10.1.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely problem?

Accepted Answer

No traffic matching ACL 150 is arriving on GigabitEthernet0/0.. The route map has a deny sequence 20 with no match clause, which means it matches all packets. Since route maps are processed in order, if sequence 10 does not match (zero matches), sequence 20 will match all remaining packets and deny them (i.e., not apply PBR), causing them to be routed normally. However, the counters show zero for both sequences, indicating no traffic is being processed at all, likely because no traffic matching ACL 150 arrives on the interface.

Answer

The deny sequence 20 is blocking all traffic from being policy-routed.

Answer

The next-hop 10.0.0.2 is unreachable.

Answer

The route map is missing a permit statement.

Question 17

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-SET

R1# show route-map PBR-SET
route-map PBR-SET, permit, sequence 10
  Match clauses:
    ip address (access-lists): 160
  Set clauses:
    ip next-hop 192.168.1.2
    ip tos 184
  Policy routing matches: 300 packets, 24000 bytes

R1# show access-lists 160
Extended IP access list 160
    10 permit ip 10.0.0.0 0.255.255.255 any

R1# show interfaces GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet address is 10.0.0.1/24

Based on this output, a packet from source 10.0.0.5 to destination 8.8.8.8 arrives on GigabitEthernet0/0. What is the most likely behavior?

Accepted Answer

The packet is forwarded to 192.168.1.2 with the ToS field set to 184.. The packet matches ACL 160 (source 10.0.0.0/8). The route map sets both next-hop and ToS. The next-hop 192.168.1.2 must be reachable for PBR to apply. Assuming it is reachable (not shown but implied by matches), the packet will be forwarded to 192.168.1.2 with ToS set to 184 (which is 0xB8, or IP precedence 5, DSCP 46).

Answer

The packet is forwarded using the routing table because the next-hop is not specified correctly.

Answer

The packet is dropped because the ToS value is invalid.

Answer

The packet is forwarded to 192.168.1.2 but the ToS is not changed.

Question 18

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-TRACK

R1# show route-map PBR-TRACK
route-map PBR-TRACK, permit, sequence 10
  Match clauses:
    ip address (access-lists): 170
  Set clauses:
    ip next-hop verify-availability 10.0.0.2 10 track 2
  Policy routing matches: 100 packets, 8000 bytes

R1# show track 2
Track 2
  IP SLA 2 reachability
  Reachability is Up
    2 changes, last change 00:01:30
  Latest operation return code: ok
  Tracked by:
    ROUTE-MAP 0

R1# show ip route 10.0.0.2
Routing entry for 10.0.0.2/32
  Known via "eigrp 1", distance 90, metric 28160
  Last update from 192.168.1.2 on GigabitEthernet0/1

Based on this output, what is the most likely behavior for packets matching ACL 170?

Accepted Answer

Packets are forwarded to 10.0.0.2.. The route map uses 'ip next-hop verify-availability' with track 2. Track 2 is Up (IP SLA 2 reachability is ok). Therefore, the next-hop 10.0.0.2 is considered available, and packets matching ACL 170 are forwarded to 10.0.0.2.

Answer

Packets are forwarded using the routing table because the next-hop is not reachable.

Answer

Packets are dropped because the track object is not configured correctly.

Answer

Packets are load-balanced between the next-hop and the routing table.

Question 19

Router R1 has the following configuration:
```
interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 ip policy route-map PBR-OUT
!
route-map PBR-OUT permit 10
 match ip address 100
 set ip next-hop 192.168.1.1
!
access-list 100 permit ip host 10.1.1.100 any
```
What is the effect of this configuration?

Accepted Answer

Packets received on GigabitEthernet0/1 from source 10.1.1.100 are forwarded to next-hop 192.168.1.1.. The route-map is applied as an inbound policy on the interface, but the name 'PBR-OUT' suggests outbound, which is misleading. However, the 'ip policy route-map' command applies to incoming packets on that interface. The ACL matches source 10.1.1.100 to any destination, and sets next-hop 192.168.1.1.

Answer

Packets transmitted out of GigabitEthernet0/1 to destination 10.1.1.100 are forwarded to next-hop 192.168.1.1.

Answer

All packets from 10.1.1.100 are dropped because the route-map does not have a permit statement.

Answer

The configuration is invalid because the ACL must match destination, not source.

Question 20

Router R2 has the following configuration:
```
interface GigabitEthernet0/2
 ip address 10.2.2.2 255.255.255.0
 ip policy route-map CHECK
!
route-map CHECK permit 10
 match ip address 101
 set interface GigabitEthernet0/3
!
access-list 101 permit tcp any any eq 80
```
What is the effect of this configuration?

Accepted Answer

Incoming TCP packets with destination port 80 on G0/2 are forwarded out G0/3, overriding the routing table.. The route-map matches TCP traffic with destination port 80 (HTTP) and sets the output interface to GigabitEthernet0/3. This is applied inbound on GigabitEthernet0/2.

Answer

Outgoing TCP packets with source port 80 on G0/2 are forwarded out G0/3.

Answer

All TCP traffic is forwarded out G0/3 regardless of port.

Answer

The configuration is invalid because 'set interface' cannot be used with a route-map.