2

In order to test a new firewall I just set up I'm trying to implement policy based routing on our core switch. I want traffic from certain vlans to be routed to the new firewall while everything else continues being routed through the old firewall. I was trying to use this guide. Everything from that guide works fine except trying to run the "ip policy route-map" command in the interface configuration mode. IOS is telling me that such a command doesn't exist. A "show ip interface vlan" command says that policy routing is disabled. Any ideas?

Output of "show ver":

Cisco IOS Software, Catalyst 4500 L3 Switch Software (cat4500-IPBASEK9-M), Version 12.2(53)SG, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Thu 16-Jul-09 19:49 by prod_rel_team
Image text-base: 0x10000000, data-base: 0x11D1E3CC

ROM: 12.2(31r)SG2
Dagobah Revision 226, Swamp Revision 34

RTTMCB2223-1 uptime is 3 years, 22 weeks, 2 days, 19 hours, 28 minutes
Uptime for this control processor is 51 weeks, 2 days, 18 hours, 2 minutes
System returned to ROM by power-on
System restarted at 19:22:02 UTC Tue Jul 12 2011
System image file is "bootflash:cat4500-ipbasek9-mz.122-53.sg.bin"

...

cisco WS-C4510R (MPC8245) processor (revision 4) with 524288K bytes of memory.
Processor board ID FOX103703W3
MPC8245 CPU at 400Mhz, Supervisor V
Last reset from PowerUp
42 Virtual Ethernet interfaces
244 Gigabit Ethernet interfaces
511K bytes of non-volatile configuration memory.

Configuration register is 0x2
Mike Pennington
  • 8,305
  • 9
  • 44
  • 87
Logan
  • 23
  • 4
  • could you add the output of "show ver" to this question? – Mike Pennington Jul 06 '12 at 19:05
  • By the way, I have often observed that people would generally prefer to use [VRF-lite](http://packetlife.net/blog/2009/apr/30/intro-vrf-lite/) instead of PBR. Much depends on the requirements, but if this subnet to be policy-routed is isolated from subnets assigned to the other gateways, VRF-Lite might be useful to you. – Mike Pennington Jul 06 '12 at 19:36

1 Answers1

3

You have an "IPBASEK9" image, but you need "ENTERPRISESERVICES" to use Policy-based routing; you probably want ENTERPRISESERVICESK9, since the original image is a crypto image (K9 suffix).

Please see page 2 of this Catalyst 4500 Features at a Glance brochure.

Mike Pennington
  • 8,305
  • 9
  • 44
  • 87