Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In order to test a new firewall I just set up I'm trying to implement policy based routing on our core switch. I want traffic from certain vlans to be routed to the new firewall while everything else continues being routed through the old firewall. I was trying to use this guide. Everything from that guide works fine except trying to run the "ip policy route-map" command in the interface configuration mode. IOS is telling me that such a command doesn't exist. A "show ip interface vlan" command says that policy routing is disabled. Any ideas?

Output of "show ver":

Cisco IOS Software, Catalyst 4500 L3 Switch Software (cat4500-IPBASEK9-M), Version 12.2(53)SG, RELEASE SOFTWARE (fc3)
Technical Support:
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Thu 16-Jul-09 19:49 by prod_rel_team
Image text-base: 0x10000000, data-base: 0x11D1E3CC

ROM: 12.2(31r)SG2
Dagobah Revision 226, Swamp Revision 34

RTTMCB2223-1 uptime is 3 years, 22 weeks, 2 days, 19 hours, 28 minutes
Uptime for this control processor is 51 weeks, 2 days, 18 hours, 2 minutes
System returned to ROM by power-on
System restarted at 19:22:02 UTC Tue Jul 12 2011
System image file is ""


cisco WS-C4510R (MPC8245) processor (revision 4) with 524288K bytes of memory.
Processor board ID FOX103703W3
MPC8245 CPU at 400Mhz, Supervisor V
Last reset from PowerUp
42 Virtual Ethernet interfaces
244 Gigabit Ethernet interfaces
511K bytes of non-volatile configuration memory.

Configuration register is 0x2
share|improve this question
could you add the output of "show ver" to this question? – Mike Pennington Jul 6 '12 at 19:05
By the way, I have often observed that people would generally prefer to use VRF-lite instead of PBR. Much depends on the requirements, but if this subnet to be policy-routed is isolated from subnets assigned to the other gateways, VRF-Lite might be useful to you. – Mike Pennington Jul 6 '12 at 19:36
up vote 3 down vote accepted

You have an "IPBASEK9" image, but you need "ENTERPRISESERVICES" to use Policy-based routing; you probably want ENTERPRISESERVICESK9, since the original image is a crypto image (K9 suffix).

Please see page 2 of this Catalyst 4500 Features at a Glance brochure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.