Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

PBR using Next_hop


I am looking to define a PBR to a number of different gateways based on first the verify availability and then based on source IP address match.

I currently have PBR setup to change the default gateway based on the source IP Address defined in a couple of ACL. The policy is assigned to all interfaces connected to the router. This is and has been working fine for a number of years.

route-map Internet, permit, sequence 40

  Match clauses:

    ip address (access-lists): ContentBypass

  Set clauses:

    ip default next-hop

  route-map Internet, permit, sequence 60

  Match clauses:

    ip address (access-lists): InternetAccess

  Set clauses:

    ip default next-hop

We have expanded our Internet access by adding an ISP to another site. We now have two Internet connections, each attached to a 6509. The current configuration works fine on each site. I want to modify it to use the “set ip next-hop verify-availability”  command . Working in stages I modified a test interface to run the following configuration with just the next_hop change before going to the verify availability command.

route-map Internet permit 40

description Inside - System Bypass of Content Management

match ip address ContentBypass

set ip default next-hop


route-map Internet permit 50

description test_Inside

match ip address Test

set ip next-hop


route-map Internet permit 60

description District - Default Internet Access Policy

match ip address InternetAccess

set ip default next-hop

The source IP defined in the “test_Inside”  is a subnet defined on a vlan interface.

When I use the” set ip default next-hop” command, it works fine, When I change to the “set ip next-hop” I cannot even ping the Vlan interface ip address.

Any help would be appreciated


Everyone's tags (1)
Hall of Fame Super Silver

Re: PBR using Next_hop

Hello Dan,

the two commands make different actions:

set ip default next-hop

first look at IP routing table, if an explicit route is found use that route to send the packet. If no explicit route is found then use the specified next-hop

set ip next-hop

send packet to specified next-hop if the next-hop is available

If you want to use the other internet connection for the test vlan IP subnet when it is the source you should use the first option or all traffic will be sent to next-hop when the source is in that IP subnet.

Hope to help


Community Member

Re: PBR using Next_hop

Thanks for the quick reponse

I keep thinking that I understand the differences, but the results confuse me.

The 192.168.40.x subnet is directly connected to the router and is in the route table. I see the destination address of in the ARP table also.

The default gateway defined on the router is  - which is the other site with the original ISP connection.

I really liked how the default next_hop was been working by checking the route tables first and then modifying the next-hop if not found in the route table.

I believe that I need to remove the default option to set up a SLA / tracking and use the verify_availablity option. The network is basically a layer 2 network with 20 some sites. Two large sites, each with an ISP connection. All the edge sites will access the Internet through one of these two large site. I am trying to setup a set of PBR at each of the two large sites to redirect the internet traffic to the other site based on the "verify_availablity" of the local ISP. The other statements in the PBR are to direct traffic to a defined port on the ASA to bypass content filtering as needed.

Gateway of last resort is to network is subnetted, 2 subnets
C is directly connected, Vlan996
C is directly connected, Vlan995 is variably subnetted, 118 subnets, 4 masks
C is directly connected, Vlan43

C is directly connected, Vlan44

C is directly connected, Vlan255

S* [1/0] via

Edge sites stripped out. What am I missing is explicitly defined and when I use the default option everything works



CreatePlease to create content