Route-map with ACL

Question:

I have a PBR with WS-C3750X-48PF-L route-map applied on the LAN interface of the router. PBR has below route-map :

R1 :

route-map PBR permit 10

match ip address OFFLOAD

set ip next-hop 172.16.1.5

ACL contents :

ip access-list extended OFFLOAD

deny tcp 10.0.0.0 0.255.255.255 20.0.0.0 0.0.3.255 eq 14xx

deny ip 10.0.0.0 0.255.255.255 host 30.1.1.1

deny ip 10.0.0.0 0.255.255.255 host 30.1.1.5

permit ip 10.0.0.0 0.255.255.255 any

int fa 0/0

ip add 172.16.1.2 255.255.255.0

stand 1 ip 172.16.1.1

stand 1 preempt

ip policy route-map PBR

R2 :

R2 has same interface config with HSRP with Fa0/0 of R1. The policy is applied to offload traffic from R1 to R2 i.e. keep only denied traffic in ACL on R1 WAN link.

But some how the policy is not working and denied traffic is going via R1 itself. I guess we can't use deny statements in route-map ?

Answer:

Thank you for the additional explanation which does help to clear up the issue. Some people do get confused about what happens when the access list in PBR has deny statements, so you are in good company about this. If a packets matches the deny in the access list used in PBR then it just follows the normal routing logic.

Some people assume that if an access list denies a packet that the packet is dropped and not forwarded. This is true if the access list is used on an interface with access-group. But it is not the case with PBR. When used with PBR the deny just says "do not use PBR logic" and the regular routing logic is used. So I would expect that any traffic that is denied in the access list (any host in 10.0.0.0 with destination 30.1.1.1 or 30.1.1.5) will use the outbound connection on R1. For futher information, please refer to http://www.3anetwork.com/cisco-ws-c3750x-48pf-s-price_p122.html