0

I have a Cisco C3560X with multiple internal networks (10.0.0.0/24, 10.0.1.0/24, et.) and two internet connections (10.0.0.3 and 10.0.0.4). The default gateway for the internal subnets is the switch (10.0.0.1), and the 0.0.0.0 route in the switch is the internet connection at 10.0.0.4.

I have one host (10.0.0.11) that I need to use the 10.0.0.3 connection instead of .4

I think that policy based routing will let me do this, but all of the examples I have seen don't address an important requirement I have: the host in question needs to be able to talk to hosts on other internal subnets, 10.0.1.0/24 for example. The examples appear to route any traffic from the host to that next hop, not differentiating between destinations.

How can I configure PBR to send internet traffic for one host out an alternate connection, while still being able to reach other hosts on other internal subnets?

Improve this question
1
  • 2
    More specific routes take precedence over less specific routes, and 0.0.0.0/0 is the least specific route there is. Routing 10.0.0.0/8 to one gateway and 0.0.0.0/0 to a different gateway means that the more specific /8 route will be used for the 10.0.0.0/8 network, and anything else will go to the default route, which is called the route of last resort just for that reason.
    – Ron Maupin ♦
    Commented Sep 22, 2022 at 3:31

1 Answer 1

Reset to default
4

I've made a few assumptions in this example here (VLAN 10), but this should work for you:

ip access-list extended PBR-EXAMPLE
 deny ip host 10.0.0.11 10.0.0.0 0.255.255.255
 permit ip host 10.0.0.11 any

route-map POLICY-EXAMPLE permit 10
match ip address access-list PBR-EXAMPLE
set ip next-hop 10.0.0.3

interface vlan 10
description This is the normal gateway for devices
ip address 10.0.0.1 255.255.255.0
ip policy route-map POLICY-EXAMPLE
Improve this answer
3
  • Thank you. That matches the examples I've been looking at. But the part I don't understand is what allows 10.0.0.11 to talk to 10.0.1.99, which is in a different subnet, and reachable because 10.0.0.1 has a route to that subnet. It appears to me that the route-map will just send all traffic to 10.0.0.3. I feel like I'm missing something obvious.
    – longneck
    Commented Sep 22, 2022 at 13:31
  • 1
    The first line in the access list (deny ip host 10.0.0.11 10.0.0.0 0.255.255.255) excludes any traffic from the host at .11 to any 10.x network. So the policy will not apply to that traffic, and it will be routed normally.
    – Ron Trunk
    Commented Sep 22, 2022 at 13:54
  • OK, thank you very much. I finally understand what I was missing. All the examples I looked at use a standard ip access-list, not an extended one. I didn't realize until I implemented this tonight that an extended ip access-list was the missing piece.
    – longneck
    Commented Sep 26, 2022 at 2:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.