Is an inverse access list configuration possible?

[jeff20]

I'm working on a Nexus 9000 whose purpose is to redirect traffic to a web content filtering system with ITD.  There is an access list that works to match traffic with specific sources and destinations and sets a next hop ip address in the route map which sends traffic to the web filter. 

However, I don't want to specify all the traffic that I do want to be re-directed and filtered.  I'd like to specify the sources and destinations that I don't want to be re-directed with the next hop.  Is it possible to turn this logic around, to re-direct all traffic except what's specified in the access list?  Thanks for any ideas.

[Torbjørn]

You can achieve this by creating a "permit Ip any any" catch-all entry in the bottom of your access list and create specific deny entries for all traffic you don't want to be redirected above your catch-all. 

[jeff20]

Thank you. I did try something like that, but the deny doesn't seem to have any effect. If I have the catch-all at the bottom, the traffic still gets re-directed.

ip access-list iboss_LAN
15 deny ip 10.110.19.3/32 164.104.1.0/24
20 permit ip 10.110.19.3/32 104.17.17.87/32
25 permit ip 10.110.19.3/32 204.79.197.200/32
30 permit ip 10.110.19.3/32 104.17.18.87/32
35 permit ip 10.110.19.3/32 146.75.95.5/32
40 permit ip 10.110.19.3/32 108.156.201.0/24
45 permit ip 10.110.19.3/32 216.239.38.120/32
50 permit ip 10.110.19.3/32 any

[paul driver]

Hello
You can always use a deny stanza to deny any specific traffic and then allow all other traffic to be policy routed

Example:
ip access-list extended iboss_LAN
permit ip 10.110.19.3/32 164.104.1.0/24

route-map PBR deny 5
match ip address iboss_LAN

route-map PBR permit 99
set ip next-hop x.x.x.x

[jeff20]

Thanks for the suggestions, makes sense.  In this case, my problem was that the exclude access list I wanted needed to be configured within the ITD service.  I was trying to divert traffic in a more traditional way, but apparently ITD builds the route maps based on the ACL that are part of the ITD configuration.  Thanks for the help.