3

In my network I use L3-3650x as core switch to route internal network. I have 2 internet gateways, one for local internet [192.168.2.1] and the other for Japan connection [172.17.138.1]. Both routers provide internet connection but I want to separate internet usage in network by source address like if come from network 172.17.138.0/24 or 172.17.160.0/24 connect internet via router 172.17.138.1 and if come from 192.168.2.0/24 network connect via 192.168.2.1

Click image for larger version: enter image description here

It is possible to setting like this ?

Any idea will be much appreciate.

Below is show version command result.

[Apologize for my bad English]

SEPT_L3#show version
Cisco IOS Software, C3560E Software (C3560E-UNIVERSALK9-M), Version 12.2(55)SE3,                                                                                  RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2011 by Cisco Systems, Inc.
Compiled Thu 05-May-11 15:57 by prod_rel_team
Image text-base: 0x00003000, data-base: 0x02800000

ROM: Bootstrap program is C3560E boot loader
BOOTLDR: C3560E Boot Loader (C3560X-HBOOT-M) Version 12.2(53r)SE2, RELEASE     SOFTW                                                                             ARE (fc1)

SEPT_L3 uptime is 4 weeks, 2 days, 1 hour, 51 minutes
System returned to ROM by power-on
System image file is "flash:/c3560e-universalk9-mz.122-55.SE3/c3560e-universalk9         -mz.122-55.SE3.bin"


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
[email protected].

License Level: ipbase
License Type: Permanent
Next reload license Level: ipbase

cisco WS-C3560X-24 (PowerPC405) processor (revision A0) with 262144K bytes of memory.
Processor board ID FDO1629P186
Last reset from power-on
4 Virtual Ethernet interfaces
1 FastEthernet interface
28 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : 60:73:5C:00:78:00
Motherboard assembly number     : 73-12554-06
Motherboard serial number       : FDO162911ZG
Model revision number           : A0
Motherboard revision number     : A0
Model number                    : WS-C3560X-24T-S
Improve this question
2
  • I think you can use Access List on Core Switch to do this. I see this is Packet Trace is you need assistance to learn about let me know.
    – jfidel87
    Jun 6, 2014 at 13:29
  • Thank you very much for your help. I will try as your tell me. ^^
    – Anue
    Jun 8, 2014 at 7:02

1 Answer 1

Reset to default
8

What you like to perform is Policy Based Routing. By default, the L3 device define the next-hop based on destination IP. On cisco router, PBR allow you to route packet based on policy through Route-map. So you can create a Route-map and match traffic with an ACL and set a next-hop, after you have to apply in which interface the policy should be active.

Unfortunately on Packet Tracer, this features is not available so you can't implement that on you scenario.

If you have the opportunity to implement your scenario in a real equipment lab, here are the commands to configure PBR following your topology.

route-map ISP-Outside permit 10
match ip address INTERNET-ACCESS_192
set ip next-hop 192.168.2.1 
route-map ISP-Outside permit 20
match ip address INTERNET-ACCESS_172
set ip next-hop 172.17.138.1

interface GigabitEthernet0/1 ! in all interface you want to implement this policy 
ip policy route-map ISP-Outside

ip access-list extended INTERNET-ACCESS_192
permit ip 192.168.2.0 0.0.0.255 any
deny ip any any

ip access-list extended INTERNET-ACCESS_172
permit ip 172.17.0.0 0.0.255.255 any
deny ip any any

Also see Policy-Based Routing on Cisco's documentation site.

Improve this answer
9
  • Thank you very much for comment and answer i will try this in packet tracer and real environment. I will comeback with my result in next 2-3 day
    – Anue
    Jun 8, 2014 at 7:00
  • Hi @cdq74cn Soory for late reply result But it error show in my switch.I use command as you show me but in line 9. *ip policy route-map ISP-Outside it tell me that error from p in word policy Why i can not use it? My switch not have this function? Or do i need to enable any function first ? I do need your help.
    – Anue
    Jun 10, 2014 at 11:55
  • Can you provide the model and IOS of your switch ?
    – cgasp
    Jun 10, 2014 at 21:07
  • I use Cisco 3650-x.
    – Anue
    Jun 10, 2014 at 23:17
  • and in my question already have show version command. If any command I should do please let me know.
    – Anue
    Jun 11, 2014 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.