Here is the scenario. Currently there is a flat layer 2 network with a single /24 subnet. The intent is to segment that /24 using a layer 3 switch. On the /24 network there exists clients with differing default gateways. There are multiple exit points from the /24 network. If the layer 3 switch is implemented using multiple routing interfaces to join the newly segmented network, is it possible to assign different default gateways to the individual routing addresses to accomplish having multiple exists from the network as a whole onto the WAN? Is there a hard limitation that the switch performing the layer 3 routing can only have one default gateway? Example details below.

Current Example network

  • network
  • edge router 1:
  • edge router 2:
  • Client A:, GW
  • Client B:, GW

Example Target network

  • network 1:
  • edge router 1:
  • edge router 2:

layer 3 swtich

  • routing inf 1:
  • routing inf 2:
  • routing inf 3: 192.168.300.3
  • default GW:

Network 2:

  • Client A:, GW

Network 3: 192.168.300.0/24

  • Client B: 192.168.300.1, GW 192.168.300.3

In this example the hardware used for as the layer 3 switch would be a Netgear M4300

Can the desired outcome of having Client A and B exit the network on the originally specified edge routers be achieved?

2 Answers 2


Is it possible to assign a default gateway per routing interface on a layer 3 switch?

If I understand your question correctly, you'd like to point the L3 switch's default route to an edge router, and the edge router's to WAN? That's a common configuration for a core switch and your WAN firewall, certainly possible.

A router/switch/node can have multiple default routes, but that can cause undesired behavior: equal-prefix routes with the same metric may be chosen at random, round robin or all but one are simply ignored, depending on platform and configuration. But your example isn't really about that.

If you want packets to routed via different default gateways depending on the source subnet then you'll need policy-based routing (PBR) on the L3 switch.

  • My understanding is that source based routing is undesirable (if not down right insecure) so I was trying to engineer a configuration that included the common hop (the layer 3 switch) but still retained the desired effect of having Client A and B exit to the WAN via different routers/firewalls. I haven't investigated PBR so I'll give that a look and see if the example switch has support. Jan 12 at 21:15
  • Source routing is a security risk and (mostly) obsolete. Source-based routing isn't and it's quite common. The former uses a hop list provided by the source node, the latter policies on the router(s).
    – Zac67
    Jan 12 at 21:20

My initial reaction to the question as stated is: You're probably doing something wrong and this is not the way to solve it. Unusually complicated requests like this usually indicate something in the network design is not as well thought out as it could be and this request is an effort to patch over a problem that could be solved a better way.

The common solution to the need to isolate networks on a single layer 3 gateway and provide separate routing implementations for those networks is VRF-Lite or full VRF (Virtual Routing & Forwarding) which allows you to have multiple 'routing tables' in use for independent/isolated networks. For example, if you are a service provider you can provide internet services for multiple customer networks with different routing designs for each one without having to implement multiple gateway devices for each customer.

Your proposed Netgear switch does not support VRF.

Policy-Based Routing will probably accomplish what you describe but will add a level of complexity and fragility that might not be desirable. It probably depends on how often you expect to need to work on the network or make changes to how things work and on how many different people need to understand how it all works.

See the section on Policy Based Routing in the following manual and look for the ability to set the next hop address. That will allow you to select source networks (via access-list qualification) and forward their outbound traffic to a desired gateway address other than the actual default gateway of the layer 3 switch.


Alternately, look into SD-WAN (software defined wide area network) implementations which allow you to easily define types of traffic (HTTPS vs. DNS, for example), applications, source networks or destination networks that should be carried over one network or another or one WAN service or another, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.