ACLs and pbr service groups on 5406

[cwnz]

Hi 

I have a 5406R and I have multiple VLANS which use a service-policy pbr to forward specific traffic to a proxy server.  This is working for me.

I also want to apply an ACL on thie VLAN restrict traffic from devices on this vlan going out.  This also works fine, except when this ACL policy is applied on the VLAN, the service-policy doesnt work.

The service-policy pbr works fine by itself, but as soon as I apply the ACL access-group, it breaks the pbr.

this is my vlan

vlan 500
name "VLAN500"
ip address 10.5.0.254 255.255.255.0
ip access-group "ACL_LIST" in
service-policy "PROXY_PBR" in
exit

policy pbr "PROXY_PBR"
10 class ipv4 "PROXY-CLASS"
action ip next-hop 192.168.0.10
exit
exit

ip access-list extended "ACL_LIST"
10 permit ip 10.5.0.0 0.0.0.255 192.168.0.10 0.0.0.0 log
20 permit ip 10.5.0.0 0.0.0.255 192.168.20.0 0.0.0.254 log
30 deny any any
exit

Any Ideas?

[network_king]

Create the traffic classes:

Rack2sw1(config)# class ipv4 TCP
Rack2sw1(config-class)# match tcp 10.0.8.1/24 15.29.16.104/24 eq 80
Rack2sw1(config-class)# match tcp 10.0.8.1/24 15.29.16.104/24 eq 22
Rack2sw1(config-class)# match tcp 10.0.8.1/24 15.29.16.104/24 eq 23
Rack2sw1(config-class)# exit

Rack2sw1(config)# class ipv4 UDP
Rack2sw1(config-class)# match udp 10.0.8.1/24 15.29.16.104/24 eq 80
Rack2sw1(config-class)# match udp 10.0.8.1/24 15.29.16.104/24 eq 22
Rack2sw1(config-class)# match udp 10.0.8.1/24 15.29.16.104/24 eq 23
Rack2sw1(config-class)# exit

Verify traffic classes:

Rack2sw1(config)# show class config

class ipv4 "TCP"
     10 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 80
     20 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 22
     30 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 23
   exit
class ipv4 "UDP"
     10 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 80
     20 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 22
     30 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 23
   exit

Create the routing policy:

Rack2sw1(config)# policy pbr TCP_UDP
Rack2sw1(policy-pbr)# class ipv4 TCP
Rack2sw1(policy-pbr-class)# action ip next-hop 20.0.0.1
Rack2sw1(policy-pbr-class)# action interface null
Rack2sw1(policy-pbr-class)# exit

Rack2sw1(policy-pbr)# class ipv4 UDP
Rack2sw1(policy-pbr-class)# action ip default-next-hop 30.0.0.1
Rack2sw1(policy-pbr-class)# action interface tunnel 3
Rack2sw1(policy-pbr-class)# exit

Verify the routing policy:

Rack2sw1# show policy config

policy pbr "TCP_UDP"
     10 class ipv4 "TCP"
      action ip next-hop 20.0.0.1
      action interface null
      exit
     20 class ipv4 "UDP"
      action ip default-next-hop 30.0.0.1
      action interface tunnel 3
      exit
   exit

Configure the VLAN for the service policy:

Rack2sw1(config)# vlan 10 service-policy TCP_UDP in

Verify the vlan policy configuration:

Rack2sw1# show policy vlan 10

 Policies for VLAN 10
 Name   : TCP_UDP
 Type   : PBR

Use the show statistics policy command to display information about which PBR action for an applied policy is active. Hit counts are displayed for each entry in the class and policy with the active action.

Rack2sw1# show statistics policy TCP_UDP vlan 10 in

 HitCounts for Policy TCP_UDP

  Total

 10 class ipv4 TCP action interface null
(       0 )      10 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 80
(       0 )      20 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 22
(       0 )      30 match tcp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 23

 20 class ipv4 UDP action ignore
(       0 )      10 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 80
(       0 )      20 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 22
(       0 )      30 match udp 10.0.8.1 0.0.0.255 15.29.16.104 0.0.0.255 eq 23