I have this Cisco 3750 switch which handles many VLANs. It has an IP interface on some of them, and it does routing for those computers connected to those VLANs which use the switch's IP addresses as their default gateway.

The switch has a default gateway, too; this is needed because one of those VLANs is connected to an Internet router, so every outgoing connection which is not directed to any specific internal subnet needs to go there.

The switch itself also has another IP address, which we use for management; this address is attached to one of the VLANs. Traffic from/to this address needs to go through another route.

The question: I want any outgoing IP connection which comes from the switch to go through a different route than its default gateway. But this should only apply to packets which originates from the switch itself; those packets which come from any device connected to any VLAN on the switch should go through the default route.

Source-based routing is what I need here; i.e. I want a static route which only applies to packets originating from the switch itself.

Can this be done on a Cisco 3750 switch?


Edit: why I want this

This is a test environment, where the default gateway is a Linux firewall which at any given time might be down; our workstations are on the other side of this firewall, and there's also some other routing in the middle.
The switch has a management IP on a subnet which is linked to our main network, where a gateway could allow it to talk with us without going through its default gateway.
And of course we don't want to lose connectivity to the switch if the test area is not fully working. But, at the same time, the switch's default gateway has to be that one, because the switch itself also acts as a router for the (many) subnets which form this test area. So I need to route through an alternate gateway all the traffic that comes from the switch, but only it.

Edit: show version

Cisco IOS Software, C3750 Software (C3750-IPBASEK9-M), Version 12.2(25)SEE1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Mon 22-May-06 08:51 by yenanh
Image text-base: 0x00003000, data-base: 0x01026AEC

ROM: Bootstrap program is C3750 boot loader
BOOTLDR: C3750 Boot Loader (C3750-HBOOT-M) Version 12.2(25r)SEC, RELEASE SOFTWARE (fc4)

SW-TEST uptime is 5 weeks, 1 day, 16 hours, 22 minutes
System returned to ROM by power-on
System image file is "flash:c3750-ipbasek9-mz.122-25.SEE1/c3750-ipbasek9-mz.122-25.SEE1.bin"

3 Answers 3


If you want to direct or tag the traffic originating from the switch or router (will work on IPBASE) I'm guessing you already succeeded but if not.

conf t

access-list 1 any

route-map pbr permit 10

 match ip address 1

 set ip next-hop


ip local policy route-map pbr



Note that ip local policy is specified in global configuration, not under an interface. And you might want to have a more detailed ACL

This is only for traffic that originates from the device, not traffic that passes through it.

  • I have notice your forgot to map policy to source Interface like this ip policy route-map pbr on Interface
    – Satish
    Nov 12, 2015 at 18:35

Cisco 3750s support "Policy-Based Routing" which will allow you to make routing decisions based on a standard ACL. Here is the PDF explaining it:

Out of curiosity, why? It seems to me like what you want to achieve might be possible another way.

From the PDF:

The following example illustrates how to route traffic from different sources to different
places (next hops). Packets arriving from source are sent to the next hop at;
packets arriving from source are sent to the next hop at

access-list 1 permit ip 
access-list 2 permit ip 

! interface fastethernet 3/1
ip policy route-map Texas
! route-map Texas permit 10
   match ip address 1 set ip next-hop
! route-map Texas permit 20
   match ip address 2 set ip next-hop  

Though in your case instead for fastethernet 3/1 you would put the vlan interface that you want the source routing to occur. If you copy and paste this code into a text editor and change the IPs and the interface to what you need you can paste it right into config mode on the switch

  • Looks promising, but also quite complex; can you give some sample configuration?
    – Massimo
    Jan 23, 2010 at 14:29
  • updated accordingly.
    – einstiien
    Jan 23, 2010 at 17:14
  • Seems exactly what I was looking for, I'm going to try it on Monday. Thanks.
    – Massimo
    Jan 23, 2010 at 22:07
  • Tried, but it doesn't work; when I try to give the command "ip policy route-map X" to a given interface (physical or VLAN), it just doesn't accept the keyword "policy". WTF?!?
    – Massimo
    Jan 25, 2010 at 11:47
  • It is possible that your version of IOS doesn't support these commands. can you post the output of show version in your original question?
    – einstiien
    Jan 25, 2010 at 16:51

As per einstiien's answer, the right thing to do is to use PBR. Unfortunately, you're using an IP Base feature set and the PBR functionality is not available in that feature set, so you'd need to buy PBR instead.

Would it be possible to simply make the management uplink part of the managemenet VLAN and provide routing to the management station? That would allow all other VLANs access to the management station via that route, but that may be fixable by providing traffic-blocking ACLs further down the line (or, possibly, on the switch itself, I can't say I recall exactly what you can and cannot do with ACLs on switch ports right now).

  • That's what we are doing now; but it's a bad solution for various reasons, and PBR would be a lot better. I'll see if we can do a IOS upgrade; what feature set is actually needed?
    – Massimo
    Jan 26, 2010 at 13:26
  • The lowest I can find is "IP Services".
    – Vatine
    Jan 27, 2010 at 10:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .