Set ip default next-hop and Cat 3750

[l.buschi]

I just checked that PBR with setting ip default next-hop is not available on cat 3750.

Does anyone know if there is another way to do dual-homing ISP without this feature?

Thanks

Johnny

[John Blakley]

What version ios are you running? I have the option on mine:

Switch(config-route-map)#set ip default next-hop ?

  A.B.C.D              Default next hop IP address

  verify-availability  Verify if default nexthop is a CDP neighbor

Switch(config-route-map)#set ip default next-hop

Version 12.2(44)SE5

HTH,

John

[l.buschi]

you can configure set ip default next-hope but when you appli the policy to an interface it's refused.

3750 doesn't support set ip default next-hop

[John Blakley]

Policy routing in general isn't supported if your sdm template isn't configured for routing:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_55_se/configuration/guide/swsdm.html#wp1139579

You can do a "show sdm prefer" to see what your current template is set for.

HTH,
John

*** Please rate all useful posts ***

[l.buschi]

yes SDM template was configured to routing and the switch rebooted. IOS is ip service.

The problem is that ip default next-hop is not supported on cat 3750

[John Blakley]

I just found this:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_52_se/configuration/guide/swuncli.html

That's new to me...sorry for sending you on a goose chase. Okay, what is it you're trying to accomplish?

HTH,
John

*** Please rate all useful posts ***

[l.buschi]

I need some vlan to reach internet from a dafault gateway A

and other vlan to reach internet from a default gateway B

[John Blakley · Accepted solution]

You could use "set ip next-hop", but when that hop is down it's not going to roll over. I don't believe the 3750 supports verify-availability either. You could possibly use eem to do something creative such as modifying your policy map should a route drop out of the table.

HTH,
John

*** Please rate all useful posts ***

[l.buschi]

I think I solved this way (hope it's fine):

I have my local subnet for istance (10.1.0.0/16 , 10.2.0.0/16, 10.60.0.0/16) which are routed by 3750 SVIs and access internet by the default route 0/0 10.60.0.253. and these are ok.

I also have traffic coming from a wan (subnets 10.70.0.0, 10.20.0.0) that need to reach my local subnets and access internet by a secondary fairewall (10.60.0.250).

so in the interface where my wan is connected i configured the following policy:

ip policy route-map PBR

route-map PBR permit 10

match ip address LOCAL

route-map PBR permit 20

set ip next-ho 10.60.0.250

IP access-list extende LOCAL

permit ip 10.0.0.0 0.255.255.255. 10.0.0.0 0.255.255.255

the statement 10 simply match communication patterns between local and private subnets and let them reach each other. (there is no set configured)

the statement 20 simply match all other traffic a (there is no acess-list) and set next-hop to the secondary firewall.

I tested it and seems to work. what do you think about?

Thanks to all for your collaboration.

Jhonny

[l.buschi]

also I don't need any fall-back mechanism in case of secondary or primary firewall failure.

[John Blakley]

That's a good way to do it...if it's working, that's awesome It's sometimes hard to get around issues when your hardware/ios doesn't support it.

HTH,
John

*** Please rate all useful posts ***