Different default routes based on source

[jbrotschul]

Hi,

I have a Cisco Catalyst 4506. Currently there is a default route configured pointing to my firewall for internet traffic...

ip route 0.0.0.0 0.0.0.0 192.168.100.7

I installed a new firewall - 192.168.4.7, and want to route traffic based on the source ip to this new firewall for only specific source ip addresses (that are in a particular vlan).

Here's my current configuration:

access-list 151 remark NEWPIX DEFAULT ROUTE
access-list 151 permit ip host 192.168.151.0 any

route-map NEWPIX_DEFAULT_ROUTE permit 10
match ip address 151
set ip default next-hop 192.168.4.7


interface Vlan50
ip address 192.168.151.4 255.255.255.0
no ip redirects
ip policy route-map NEWPIX_DEFAULT_ROUTE
standby 50 ip 192.168.151.254
standby 50 preempt


Server is 192.168.151.40 connected to this switch port:

interface FastEthernet6/45
switchport access vlan 50
switchport mode access
ip access-group 151 in


I see hit count incrementing on the ACL, and policy matches on the route-map, but internet traffic is still going out through the original firewall - 192.168.100.7.

What am I missing?

Thanks,
Jeff

 

[jimfixit]

duplicate post for which there are answers...

 

[brianinms]

This ACL is incorrect....

access-list 151 permit ip host 192.168.151.0 any


Perhaps it should be

access-list 151 permit ip 192.168.151.0 0.0.0.255

 

[burtsbees]

any

Burt

 

[KayDubYa]

I am attempting something similiar to this on a 3750 with no luck. the problem I seem to have is applying the route-map to the vlan interface. Can someone tell me if this is supported on the Catalyst 3750 and what I might be doig wrong?

 

[jimfixit]

KayDubYa

You don't say what specific problem you have but I just posted a query about applying route-maps to vlan interfaces.

I've learned on 3750 (also on my 6513) that if I have any kind of verify-availability statement on the route-map, then when I apply it to interface vlan x, I don't get any errors but neither does it apply. A show run int vlan x will not reveal any policy applied at all.

If I remove the verify-avail command from route-map, then I can apply route-map to vlan interface just fine.

This of course is a problem because if the interface is not there, you surely don't want to force your traffic to try to use it! Not being able to verify seems a pretty extreme limitation to me.

With some time in my lab I've learned I can use the verify-avaiability option on the route-map AS LONG AS I confine it to CDP methods of checking (I can't track other means such as IP response etc). In fact, I've learned that with IOS 12.2(46)SE you can't even use CDP tracking. You can with 12.2(44) but..still CDP is all you get.

HTH

 

[KayDubYa]

Thanks HTH,
I found what my problem was. It turns out that I need a software update to do what I need.

Ken