-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Typical. I think I figured it out after I asked the question. Didn't think about it before, but looks like I can match both the source IP and the outbound interface and then set ip next-hop to force the traffic to the right NAT router. Seems to prevent inter-vlan routing between (2,3,4) and (4,5,6) and gets me my desired result.
I also saw I had two vlan4 in my example. The 10.1.x.0/24 should have all been in the 5,6,7 vlans. Thanks to any who read and considered answering. I am interested if anyone has a better or more proper solution though. :) I ended up with something like this. Typed it out by hand so I hope there are no mistakes. :) ! Interface vlan 2 Ip address 192.168.0.1 255.255.255.0 Ip policy route-map private-192 ! Interface vlan 2 Ip address 192.168.1.1 255.255.255.0 Ip policy route-map private-192 ! Interface vlan 2 Ip address 192.168.2.1 255.255.255.0 Ip policy route-map private-192 ! Interface vlan 5 Ip address 10.1.0.1 255.255.255.0 Ip policy route-map private-10 ! Interface vlan 6 Ip address 10.1.1.1 255.255.255.0 Ip policy route-map private-10 ! Interface vlan 7 Ip address 10.1.2.1 255.255.255.0 Ip policy route-map private-10 ! Access-list 5 permit 192.168.0.0 0.0.0.255 Access-list 5 permit 192.168.1.0 0.0.0.255 Access-list 5 permit 192.168.2.0 0.0.0.255 Access-list 6 permit 10.1.0.0 0.0.0.255 Access-list 6 permit 10.1.1.0 0.0.0.255 Access-list 6 permit 10.1.2.0 0.0.0.255 ! Route-map private-192 permit 10 Match ip address 5 Match interface vlan5 vlan6 vlan7 Set ip next-hop 192.168.0.254 ! Route-map private-10 permit 10 Match ip address 6 Match interface vlan2 vlan3 vlan4 Set ip next-hop 10.1.0.254 Thanks, Charlie - -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Charles J. Boening Sent: Friday, March 30, 2007 9:11 PM To: [email protected] Subject: [c-nsp] policy routing - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is it possible to have a routing policy that ignores connected interfaces for certain subnets or vlans yet honors others? Take this example: Vlan 2: 192.168.0.0/24 Vlan 3: 192.168.1.0/24 Vlan 4: 192.168.2.0/24 Vlan 5: 10.1.0.0/24 Vlan 6: 10.1.1.0/24 Vlan 7: 10.1.2.0/24 Let's say that vlan 2 and vlan 4 each have a NAT router to a different provider. I don't wan the vlan 4,5,6 traffic to ever enter the vlan 2,3,4 networks and vice versa. I know I can do a policy map that sets the ip default next-hop but that won't keep vlan 2,3,4 traffic from entering vlan 4,5,6 directly and vice versa. My goal is to completely separate these subnets and vlans as if they were truly in separate routers/switches. Also, in all this, routing between the 192.168.x.0/24 subnets should occur and the same between the 10.1.x.0/24 subnets. Again, just not between the 192.168.x.0/24 networks and the 10.1.x.0/24 networks. I hope that makes sense. Any way to accomplish this within the same chassis? My switch is a 4507 with redundant SUP IV. Thanks, Charlie - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (MingW32) iD8DBQFGDd8/cGGHuFdGSWARApJ4AJ9lJ1YQhqpWVupwQR+uq435dCzsBgCdF3mI YyRt9RV3y8B+ivqheJnemhY= =JDRY - -----END PGP SIGNATURE----- _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (MingW32) iD8DBQFGDejpcGGHuFdGSWARAqcbAJ9Bse44V7TdS3FOIiMawcc3f0Id4QCeOQzL MgjOoYiDLwAcrdu5kV6NpE8= =hXzG -----END PGP SIGNATURE----- _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
