Cisco Nexus Training – Go from Beginner to Advanced!
VDC, VPC, OTV, FRX, and many more…

Policy Based Routing or PBR is a feature to manipulate routing and forwarding based on policies, set by the network administrator. In this lesson, we will learn to configure PBR in Cisco Nexus switches.

Lab Diagram:

How to configure PBR in Cisco Nexus switches

Goal of the Lab:

  • Create PBR for source PC-02 (
  • Deny PBR for PC-02 when destination is

Existing Configuration Verification:

Before configuring the PBR, let’s verify existing interface and routing configuration on NEXUS switch.

NEXUS# show ip interface brief

IP Interface Status for VRF "default"(1)
Interface            IP Address      Interface Status
Eth1/1           protocol-up/link-up/admin-up
Eth1/2           protocol-up/link-up/admin-up
Eth1/3          protocol-up/link-up/admin-up

Interface Eth1/1 is connected with RTR-01, Eth1/2 is connected with RTR-02, and Eth1/3 connects to LAN network.

I have done some traffic engineering so that all traffic chooses RTR-01 as their primary path for outgoing traffic. Now, let’s check the routing.

NEXUS# show ip route
(output omitted), ubest/mbest: 1/0
    *via, Eth1/1, [110/3], 00:26:11, ospf-1, intra, ubest/mbest: 1/0
    *via, Eth1/1, [110/3], 00:26:11, ospf-1, intra, ubest/mbest: 1/0
    *via, Eth1/1, [110/3], 00:26:11, ospf-1, intra, ubest/mbest: 1/0
    *via, Eth1/1, [110/3], 00:26:11, ospf-1, intra

(output omitted)

From above output, we can see, for any outgoing traffic, next-hop is which is RTR-01. Now, let’s verify from the source PC.

PC-01> trace
trace to, 8 hops max, press Ctrl+C to stop
 1   4.333 ms  3.862 ms  3.106 ms
 2   6.605 ms  6.296 ms  9.341 ms
 3   7.118 ms 6.567 ms  7.709 ms

PC-02> trace
trace to, 8 hops max, press Ctrl+C to stop
 1   4.206 ms  5.359 ms  5.103 ms
2   17.486 ms  16.268 ms  6.680 ms
 3   11.873 ms 6.296 ms  9.341 ms

All the traffic is going through RTR-01 which is expected. We will make sure, PC-02 ( doesn’t follow PBR when the destination is So, let’s get started.


To configure policy based routing in nexus, we need to follow simple four (4) steps. These are-

  • Enabling the feature
  • Creating Access List
  • Creating Route Map
  • Applying Route Map

Enabling the feature

feature pbr

Creating Access List
Important to know, you can’t configure deny rule in Nexus PBR. You need to configure as per below if you need to deny anything in PBR ACL. You can read more about the guideline and limitation from here. In our case, we will deny when the destination is

ip access-list OUR_PBR_DENY_ACL
permit ip host host

ip access-list OUR_PBR_PERMIT_ACL
permit ip host any

Creating Route Map
First, we will match deny ACL and then the permit. If condition matched, then next-hop will be

route-map LetsConfig_PBR_MAP deny 10
match ip address OUR_PBR_DENY_ACL
route-map LetsConfig_PBR_MAP permit 20
match ip address OUR_PBR_PERMIT_ACL
set ip next-hop

Applying Route Map
We need to add this route-map in the interface where the traffic is coming into the Nexus. In our case, it’s Eth1/3 which in LAN interface.

int eth1/3
ip policy route-map LetsConfig_PBR_MAP

Additional Configuration:
If we want to see the PBR statistics, then we need to add below command.

route-map LetsConfig_PBR_MAP pbr-statistics


NEXUS# show route-map LetsConfig_PBR_MAP pbr-statistics
route-map LetsConfig_PBR_MAP, deny, sequence 10
  Policy routing matches: 11 packets
route-map LetsConfig_PBR_MAP, permit, sequence 20
  Policy routing matches: 9 packets

Default routing: 0 packets

It’s clearly showing, we are getting hits, which means our PBR is working. You also can trace from PC-02 to make sure it’s working.

PC-02> trace
trace to, 8 hops max, press Ctrl+C to stop
 1   4.554 ms  2.957 ms  3.200 ms
 2   35.764 ms  6.290 ms  6.447 ms
 3   5.785 ms  6.705 ms  6.705 ms

PC-02> trace
trace to, 8 hops max, press Ctrl+C to stop
 1   3.549 ms  9.537 ms  4.240 ms
 2   9.304 ms  5.785 ms  6.705 ms
 3  6.126 ms  6.603 ms  5.030 ms

PC-02> trace
trace to, 8 hops max, press Ctrl+C to stop
 1   4.237 ms  4.183 ms  2.886 ms
 2   6.126 ms  6.603 ms  5.030 ms
 3   4.554 ms  2.957 ms  3.200 ms

If you have any question regarding, how to configure PBR in Cisco Nexus switches, do let us know :).

Written by Rajib Kumer Das

I am Rajib Kumer Das, a network engineer with 8+ years of experience in multi-vendor environment. In my current position, I am responsible to take care critical projects and it's support cases. I do have several vendor certificates and have plans to go further.

This article has 8 comments

  1. Ratheesh Reply

    HI , I would like to know that how to configure back up next-hop IP address in the same route-map sequence.

    My requirement is :-

    I have primary & secondary WAN link .Primary must be preferred next-hop of PBR and secondary for backup if primary goes down .

  2. Nishant Reply

    Created route-map name is LetsConfig_PBR_MAP
    But, in additional config and verification section, route-map names are showing different.
    is this correct?

Leave a Comment

Your email address will not be published. Required fields are marked *