I have an HP 5406zl layer 3 switch. Attached below is a simple diagram of the network. the network (vlan 10) has the gateway which sits behind the switch. And the network (vlan 20) has it's gateway on the switch (

simple network diagram

Currently what happens is when i want to reach vlan 20 from vlan 10, the traffic flow to the router behind the swtch and then back to the switch and to vlan 20. I want to know if its possible to create a Policy Based Route on the switch which would directly route the traffic coming from vlan10 to vlan20 without going to the vlan10 gateway(router). And all other traffic from vlan 10 should go to the the router.

  • This isn't a question for policy based routing, it's just routing. As Ron points out, moving the gateways for VLAN10 and VLAN20 to the switch will cause the packets to be routed on the switch. Set up a third subnet between the router and the L3 switch and a default via the router (..and a return path on the router via the L3 switch) and you'll have a solid network. For your reference PBR is used to make routing decisions based on criteria other than destination address (...so route UDP packets via X, everything else via Y) and isn't very common in most networks.
    – rnxrx
    Dec 14, 2016 at 1:24

2 Answers 2


If the switch isn't routing, then you need to do PBR on the router.

The proper way to configure your network is to make the layer-3 switch the gateway for both VLANs, and create a routed link from the layer-3 switch to the WAN router. The layer-3 switch should be the LAN router, separate from the WAN router.


HP 5406zl max's out at 150 ports. Just change your IP scheme to a /22 which accommodates 1024 hosts and run a single VLAN across switches. You might even be able to get away with a /24 subnet on a single VLAN across the switches.

If you have a good reason for and insist on multiple VLAN's, you'll get best inter-vlan performance on that 5406 switch, however, if you happen to have a transparent or virtual wire firewall, the router on a stick topology (routing in the router vs the switch) is required to enable that (so you can insert in the path of intervlan frames/packets).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.