In order to test a new firewall I just set up I'm trying to implement policy based routing on our core switch. I want traffic from certain vlans to be routed to the new firewall while everything else continues being routed through the old firewall. I was trying to use this guide. Everything from that guide works fine except trying to run the "ip policy route-map" command in the interface configuration mode. IOS is telling me that such a command doesn't exist. A "show ip interface vlan" command says that policy routing is disabled. Any ideas?

Output of "show ver":

Cisco IOS Software, Catalyst 4500 L3 Switch Software (cat4500-IPBASEK9-M), Version 12.2(53)SG, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Thu 16-Jul-09 19:49 by prod_rel_team
Image text-base: 0x10000000, data-base: 0x11D1E3CC

ROM: 12.2(31r)SG2
Dagobah Revision 226, Swamp Revision 34

RTTMCB2223-1 uptime is 3 years, 22 weeks, 2 days, 19 hours, 28 minutes
Uptime for this control processor is 51 weeks, 2 days, 18 hours, 2 minutes
System returned to ROM by power-on
System restarted at 19:22:02 UTC Tue Jul 12 2011
System image file is "bootflash:cat4500-ipbasek9-mz.122-53.sg.bin"


cisco WS-C4510R (MPC8245) processor (revision 4) with 524288K bytes of memory.
Processor board ID FOX103703W3
MPC8245 CPU at 400Mhz, Supervisor V
Last reset from PowerUp
42 Virtual Ethernet interfaces
244 Gigabit Ethernet interfaces
511K bytes of non-volatile configuration memory.

Configuration register is 0x2
  • could you add the output of "show ver" to this question? – Mike Pennington Jul 6 '12 at 19:05
  • By the way, I have often observed that people would generally prefer to use VRF-lite instead of PBR. Much depends on the requirements, but if this subnet to be policy-routed is isolated from subnets assigned to the other gateways, VRF-Lite might be useful to you. – Mike Pennington Jul 6 '12 at 19:36

You have an "IPBASEK9" image, but you need "ENTERPRISESERVICES" to use Policy-based routing; you probably want ENTERPRISESERVICESK9, since the original image is a crypto image (K9 suffix).

Please see page 2 of this Catalyst 4500 Features at a Glance brochure.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.