I have a Cisco C3560X with multiple internal networks (,, et.) and two internet connections ( and The default gateway for the internal subnets is the switch (, and the route in the switch is the internet connection at

I have one host ( that I need to use the connection instead of .4

I think that policy based routing will let me do this, but all of the examples I have seen don't address an important requirement I have: the host in question needs to be able to talk to hosts on other internal subnets, for example. The examples appear to route any traffic from the host to that next hop, not differentiating between destinations.

How can I configure PBR to send internet traffic for one host out an alternate connection, while still being able to reach other hosts on other internal subnets?

  • 2
    More specific routes take precedence over less specific routes, and is the least specific route there is. Routing to one gateway and to a different gateway means that the more specific /8 route will be used for the network, and anything else will go to the default route, which is called the route of last resort just for that reason.
    – Ron Maupin
    Commented Sep 22, 2022 at 3:31

1 Answer 1


I've made a few assumptions in this example here (VLAN 10), but this should work for you:

ip access-list extended PBR-EXAMPLE
 deny ip host
 permit ip host any

route-map POLICY-EXAMPLE permit 10
match ip address access-list PBR-EXAMPLE
set ip next-hop

interface vlan 10
description This is the normal gateway for devices
ip address
ip policy route-map POLICY-EXAMPLE
  • Thank you. That matches the examples I've been looking at. But the part I don't understand is what allows to talk to, which is in a different subnet, and reachable because has a route to that subnet. It appears to me that the route-map will just send all traffic to I feel like I'm missing something obvious.
    – longneck
    Commented Sep 22, 2022 at 13:31
  • 1
    The first line in the access list (deny ip host excludes any traffic from the host at .11 to any 10.x network. So the policy will not apply to that traffic, and it will be routed normally.
    – Ron Trunk
    Commented Sep 22, 2022 at 13:54
  • OK, thank you very much. I finally understand what I was missing. All the examples I looked at use a standard ip access-list, not an extended one. I didn't realize until I implemented this tonight that an extended ip access-list was the missing piece.
    – longneck
    Commented Sep 26, 2022 at 2:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.