Multiple Route-maps to define routes by Source IP

Unanswered Question
Dec 17th, 2009

I have a very simple setup.  I have a cisco 837 that connects to a DSL line (via ethernet0) and I have Nat setup on that interface in an overload.  That interface also has a route-map applied to it so that it can divert some traffic based on an ACL to our vpn tunnel.

I recently got handed the task of having this branch office also test a new ISP.  The line is in, and I setup a secondary ip interface on ethernet0.  I'd like to route some machines through the new ISP while others go through the old one.

Is this possible?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (2 ratings)
Giuseppe Larosa Thu, 12/17/2009 - 11:42

Hello Mike,

combining NAT and PBR you should be able to do this.

Use extended ACLs for NAT invoked inside a route-map.

The route-map needs to have two blocks one for NATTING and diverting hosts for new ISPs, the second block can represent the current NAT.

In this case I would use an ACL that denies traffic to vpn destinations and traffic sourced by the sample hosts that should use the new ISP.

Hope to help


Mike Elliott Thu, 12/17/2009 - 12:22

Thanks Giusular

Here is my route map and nat overload statements, very simple..

ip nat inside source route-map nonat interface Ethernet0 overload

route-map nonat permit 10
match ip address 110

Access list 110 contains the traffic from my Branch subnets, to my HQ Subnets.

Ethernet0 has two IP addresses and the crypto map attached to it. is my NEW isp, and yyy.yyy.yyy.1 is my OLD isp.

interface Ethernet0
description "Connected to the Net"
ip address secondary
ip address yyy.yyy.yyy.1
ip nat outside
no ip mroute-cache
crypto map test

interface FastEthernet0

description "Internal Lan"

ip address

ip nat inside

ip route-cache policy

ip policy route-map rock

no ip mroute-cache

speed auto


Route map rock sets the next hop for site to site traffic through the vpn tunnel.

route-map rock permit 10
match ip address 123
set ip next-hop

So if I can explain it a bit better, I want to have a decision made in one of those two maps, or in another nat pool to direct "some" traffic down the OLD ISP and the rest of the traffic out the NEW ISP.  I want to define the different routes based on the source and desination IP addresses.

i.e. all VPN traffic to go through the old isp, and all other traffic to go through the new one.

The default route is currently set to the OLD ISP.

Giuseppe Larosa Fri, 12/18/2009 - 01:12

Hello Mike,

an example is provided here

in your case you need to use two statements like:

ip nat pool newISP

ip nat inside source route-map rock pool newISP overload
ip nat inside source route-map ISP1 interface eth0 overload

route-map rock is also invoked on internal LAN interface

the ACLs used in the two route-maps should clearly deny what is not to be natted by the current route-map

if for example first half of net is to be used with old ISP

access-list 111 remark acl for ISP2

access-list 111 deny ip

access-list 111 permit ip any

access-list 112 remark acl for ISP1

access-list 112 deny ip

access-list 112 permit ip any

route-map ISP1 permit 10

match ip address 112

route-map rock permit 10

match ip address 111

set ip next-hop

Hope to help


Marwan ALshawi Fri, 12/18/2009 - 02:57

i just wanna add to the nice post from Giuseppe,  that you almost need to have the exit interface matched int e route map to avoid the nat using the first nat line only

route-map xx

match interface x/x

where x/x the interface that supposd to be the exit interface for that traffic ( only required with nat command )

good luck

if helpful rate

Mike Elliott Fri, 12/18/2009 - 13:34

Could I test this out by setting up route maps for each isp like this:

route-map isp2 permit 10

match ip address 102

set ip next-hop


route-map isp1 permit 10

match ip address 101

set ip next-hop

Then use static nat translations pointing at the route-maps like this:

ip nat inside source static route-map isp2
ip nat inside source static yyy.yyy.yyy.21 route-map isp1

I am using static routes, so I could just set two static routes to

Marwan ALshawi Fri, 12/18/2009 - 16:21

Hi Mik

all of the above will work

however to make you 100% sure just follow the bellow example

first you have to have two default routes each one point to one of your ISP's link

internal network --- this go thorugh old ISP -- ISP1 -- this will use the new ISP-- ISP2

E0--To internal LAN

E1 ---to ISP1

E2 -- o ISP2

access-list 10 permit

access-list 20 permit

route-map PBR 10

match ip add 10

set ip next-hop ISP1

route-map PBR 20

match ip add 20

set ip next-hop ISP2

route-map IPS1 permit 10

match ip address 10

match interface E1

route-map ISP2 permit 20

match ip adress 20

match interface E2

interface Ethernet0 

ip nat inside

ip policy route-map PBR   ---- this will do policy based routing for you ----

ip nat inside source route-map ISP1 interface E1 overload

ip nat inside source route-map ISP2 interface E2 overload

int E1

ip nat outside

int E2

ip nat outside

good luck

if helpful Rate

Giuseppe Larosa Mon, 12/21/2009 - 08:23

Hello Marwan,

only a small note:

Mike is going to use a single WAN interface with new ISP using secondary IP address for this reason I thought that using a NAT pool to represent the secondary address is more sure, that is when we use interface type x/y in NAT we are referring to primary address.

From this the little changes in my proposal.


yes using static NAT you are in a match with the link I had provided in my second post in this thread.

Hope to help


Marwan ALshawi Mon, 12/21/2009 - 15:31

Hi Giuseppe

i think i hhavn't noticed this point

anyway still all the solutions provided in the discussion valid except as you mentioned inthe case of a scondary ip Mike needsto use a pool with overload option

thank you for you and good luck for Mike

Mike Elliott Wed, 12/23/2009 - 12:54

Thanks for everyone's help so far, I do plan on rating all of your suggestions/recommendations when I get the plan implemented.

That being said, I have not been able to configure the router yet because my new ISP has thrown a bit of a monkey wrench into things.  They have provided me with a pre-confgured Cisco DPC3000 cable modem.

They have assigned me a CIDR block instead of giving me an IP Range like I am used to.  It appears, from their documentation I should be using (seen below) as my wan interface, then using the CIDR block as my internal IP address range.  This simply won't do because we have a lot more machines inside our network than they block provisions for, and there are a lot of services in place that would be very difficult to re-work into the new address range.

Question here is, can I use this CIDR block on my 1710?  If so, what's the best way to implement it considering I want to have both ISPs up for a period of time in the transition phase?  I have been told by the ISP that it is impossible to set the WAN IP and the CIDR block on the external interface on the router.

My old isp gave me a range of 32 addresses, and a gateway to use as the default route from my router... simple enough. I set one of the range as my wan interface, use it as a nat overload IP, then I statically nat a bunch of internal machines to the outside world (hence my need for an IP Range).

The new ISP has given me this

For my wan Interface it's




For my CIDR Block

/* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;}




If I set with the right mask as a secondary.  I try and ping the upstream router and get very sketchy results.  If I ping directly to the upstream router it fails.  If I use as the source interface, I get a lot of timeouts but ocasionally I get a reply.  If I disconnect the router from the cable modem, and setup a workstation with the 178.100 address, I can ping the upstream router consistently.

Here is my config

interface Ethernet0
description "Connected to the Net"
ip address secondary
ip address yy.yy.89.66
ip nat outside
no ip mroute-cache
crypto map test
interface FastEthernet0
description "Internal Lan"
ip address
ip nat inside
ip route-cache policy
ip policy route-map rock
no ip mroute-cache
speed auto

ip route yy.yy.89.65

!route-map nonat is for vpn traffic

ip nat inside source route-map nonat interface Ethernet0 overload

Marwan ALshawi Wed, 12/23/2009 - 16:55

are using a switch between your router and ISP links

if yes

try the follwoing method

in your switch create a tunk lin to the port connected to it

in ur swtich create two vlan vlan 2 for ISP 1

and vlan 3 for ISP 2

put ISP 1 port in thre swtich int vlan 2

and isp port in the switch in vlan 3

in your router use subinterfaces instead of secondary ips

int ethernet0

no shut

ip nat outside

int ethernet 0.1

encapsulation do1q vlan 2

ip address x.x.x.x

p nat outside

int ethernet 0.2

encapsulation dot1q vlan 3

ip add y.y.y.y

ip nat outside

and use your normal nating config

good luck


This Discussion

Related Content