How is traffic treated when a deny statement is used in a PBR route-map?

350-401 By islever Editorial Last updated

Short answer

B Traffic is returned to the normal forwarding behavior of the router.

Question

When the “deny” statement is used within a route map that is used for policy-based routing, how is the traffic that matches the deny route-map line treated?
  1. Traffic is routed to the null 0 interface of the router and discarded.
  2. Traffic is returned to the normal forwarding behavior of the router. Correct Answer
  3. An additional sequential route-map line is needed to divert the traffic to the router's normal forwarding behavior.
  4. An additional sequential route-map line is needed to policy route this traffic.

Key Takeaways

This question tests whether candidates understand that a deny clause in a PBR route-map does not discard traffic; it simply returns it to normal routing-table forwarding.

In Policy-Based Routing (PBR), a route-map entry with a deny match causes the matched traffic to bypass PBR and fall back to the router's normal routing table forwarding behavior. This is a heavily tested CCNP ENCOR / ENARSI concept.

Common mistake: Candidates often choose option A, confusing a route-map deny in PBR with a route-map deny in redistribution (e.g., BGP or OSPF), where deny does filter or discard routes. In PBR, deny only means 'do not policy-route this traffic.'

Expert Analysis

Understanding Route-Map Match Semantics in Policy-Based Routing

In Policy-Based Routing (PBR), a route-map is applied to inbound traffic using the ip policy route-map command on an interface. Each route-map sequence contains match and set statements, and each sequence is marked as either permit or deny.

What does "deny" mean in a PBR route-map?

When a packet matches a route-map sequence configured with the deny keyword:

  • The router does not apply any set actions (next-hop, interface, etc.) from that sequence.
  • The traffic is not discarded and is not sent to Null0.
  • Instead, the packet is returned to the normal forwarding plane, meaning the router performs a standard RIB (routing table) lookup and forwards the packet accordingly.

This behavior is explicitly different from how deny works in route redistribution (e.g., BGP route-maps), where a deny entry prevents the route from being advertised or installed.

Why the other options are incorrect

  • Option A is wrong because PBR deny does not blackhole traffic. Sending to Null0 would require an explicit set interface Null0 under a permit sequence.
  • Option C is wrong because no additional sequence is required; the deny sequence itself already hands the packet back to normal routing.
  • Option D is wrong because a deny sequence explicitly opts out of policy routing for the matched traffic; you would need another permit sequence only if you wanted to policy-route a different set of traffic.

Community consensus

The community voted 100% for option B, and top comments reinforce that in PBR, deny = fall back to normal routing table lookup. Candidates are reminded to always distinguish the context (PBR vs. redistribution) when interpreting route-map permit/deny semantics.

Exam Strategy

When you see 'deny' in a route-map question, first identify the feature context. For PBR, deny means 'return to normal routing'; for redistribution, deny means 'filter the route.' Locking in the context before reading the options prevents the most common trap.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. a197cbf 👍 8
    B is correct. The reason for this is with Policy-based Routing (PBR), you create a route map and match on traffic specified by an ACL. Anything labeled PERMIT in the ACL will get matched on, and subject to the PBR policy. Anything labeled DENY will not be matched by the PBR policy, meaning that it will not be looked at with that specific PBR configuration, and be returned to the normal forwarding procedure.
  2. RichardIzarra 👍 2 Answered B
    El tráfico que coincide con una línea "deny" en un route-map de PBR se procesa según la tabla de enrutamiento normal del router, ignorando las políticas del route-map.
  3. yasmiine 👍 2 Answered B
    Answer B
  4. Br2 👍 1
    B is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Configure VTY Lines for Idle Session Termination

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide