Source-based routing on Cisco 3750 switch?

Question

I have this Cisco 3750 switch which handles many VLANs. It has an IP interface on some of them, and it does routing for those computers connected to those VLANs which use the switch's IP addresses as their default gateway.

The switch has a default gateway, too; this is needed because one of those VLANs is connected to an Internet router, so every outgoing connection which is not directed to any specific internal subnet needs to go there.

The switch itself also has another IP address, which we use for management; this address is attached to one of the VLANs. Traffic from/to this address needs to go through another route.

The question: I want any outgoing IP connection which comes from the switch to go through a different route than its default gateway. But this should only apply to packets which originates from the switch itself; those packets which come from any device connected to any VLAN on the switch should go through the default route.

Source-based routing is what I need here; i.e. I want a static route which only applies to packets originating from the switch itself.

Can this be done on a Cisco 3750 switch?

How?

---

Edit: why I want this

This is a test environment, where the default gateway is a Linux firewall which at any given time might be down; our workstations are on the other side of this firewall, and there's also some other routing in the middle.
The switch has a management IP on a subnet which is linked to our main network, where a gateway could allow it to talk with us without going through its default gateway.
And of course we don't want to lose connectivity to the switch if the test area is not fully working. But, at the same time, the switch's default gateway has to be that one, because the switch itself also acts as a router for the (many) subnets which form this test area. So I need to route through an alternate gateway all the traffic that comes from the switch, but only it.

---

Edit: show version

Cisco IOS Software, C3750 Software (C3750-IPBASEK9-M), Version 12.2(25)SEE1, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Mon 22-May-06 08:51 by yenanh
Image text-base: 0x00003000, data-base: 0x01026AEC

ROM: Bootstrap program is C3750 boot loader
BOOTLDR: C3750 Boot Loader (C3750-HBOOT-M) Version 12.2(25r)SEC, RELEASE SOFTWARE (fc4)

SW-TEST uptime is 5 weeks, 1 day, 16 hours, 22 minutes
System returned to ROM by power-on
System image file is "flash:c3750-ipbasek9-mz.122-25.SEE1/c3750-ipbasek9-mz.122-25.SEE1.bin"

Answer 1

If you want to direct or tag the traffic originating from the switch or router (will work on IPBASE) I'm guessing you already succeeded but if not.

conf t

access-list 1 any

route-map pbr permit 10

 match ip address 1

 set ip next-hop 3.3.3.3

exit

ip local policy route-map pbr

end

wr

Note that ip local policy is specified in global configuration, not under an interface. And you might want to have a more detailed ACL

This is only for traffic that originates from the device, not traffic that passes through it.

Answer 2

Cisco 3750s support "Policy-Based Routing" which will allow you to make routing decisions based on a standard ACL. Here is the PDF explaining it:
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/25sg/configuration/guide/pbroute.pdf

Out of curiosity, why? It seems to me like what you want to achieve might be possible another way.

From the PDF:

The following example illustrates how to route traffic from different sources to different
places (next hops). Packets arriving from source 1.1.1.1 are sent to the next hop at 3.3.3.3;
packets arriving from source 2.2.2.2 are sent to the next hop at 3.3.3.5.

access-list 1 permit ip 1.1.1.1 
access-list 2 permit ip 2.2.2.2 

! interface fastethernet 3/1
ip policy route-map Texas
! route-map Texas permit 10
   match ip address 1 set ip next-hop 3.3.3.3
! route-map Texas permit 20
   match ip address 2 set ip next-hop 3.3.3.5  

Though in your case instead for fastethernet 3/1 you would put the vlan interface that you want the source routing to occur. If you copy and paste this code into a text editor and change the IPs and the interface to what you need you can paste it right into config mode on the switch

Answer 3

As per einstiien's answer, the right thing to do is to use PBR. Unfortunately, you're using an IP Base feature set and the PBR functionality is not available in that feature set, so you'd need to buy PBR instead.

Would it be possible to simply make the management uplink part of the managemenet VLAN and provide routing to the management station? That would allow all other VLANs access to the management station via that route, but that may be fixable by providing traffic-blocking ACLs further down the line (or, possibly, on the switch itself, I can't say I recall exactly what you can and cannot do with ACLs on switch ports right now).