IP Routing Configuration Guide, Cisco Catalyst IE3x00 Rugged, IE3400 Heavy Duty, and ESS3300 Series Switches

PDF

IP Routing Configuration Guide, Cisco Catalyst IE3x00 Rugged, IE3400 Heavy Duty, and ESS3300 Series Switches

Configure PBR

Updated: June 25, 2026

Want to summarize with AI?

Log in

Configure Policy-Based Routing (PBR) to control where packets are output based on defined criteria and actions.

Configure PBR to enable policy-based routing on the switch. This feature allows you to control packet forwarding based on specific match criteria and routing policies.

By default, PBR is disabled on the switch. To enable PBR, you must create a route map that specifies the match criteria and the resulting action. Then, enable PBR for that route map on an interface. Packets that arrive on the specified interface and match the match clauses are subject to PBR.

Procedure

1.

Use the configure terminal command to enter global configuration mode.

Example:

Device# configure terminal
2.

Use the route-map map-tag [permit] [sequence number] command to define route maps that are used to control where packets are output, and enters route-map configuration mode.

Example:

Device(config)# route-map pbr-map permit

  • map-tag — A meaningful name for the route map. The IP policy route-map interface configuration command uses this name to reference the route map. Multiple route-map statements with the same map tag define a single route map.

  • (Optional) permit — If permit is specified and the match criteria are met for this route map, the route is policy routed as defined by the set actions.

  • (Optional) sequence number — The sequence number shows the position of the route-map statement in the given route map.
3.

Use the match IP address {access-list-number | access-list-name} [ access-list-number | ...access-list-name] command to match the source and destination IP addresses that are permitted by one or more standard or extended access lists. ACLs can match multiple source and destination IP addresses.

Example:

Device(config-route-map)# match ip address 110 140

If you do not specify a match command, the route map is applicable to all packets.
4.

Configure the actions within the policy route map to define next-hop routing, VRF interfaces, or IP header precedence values for matching traffic.

  1. Use the set ip next-hop ip-address [ ...IP-address] command to specify the action taken on packets that match the criteria. This command sets the next hop to which to route the packet. The next hop must directly neighbor the switch.

    Example:

    Device(config-route-map)# set ip next-hop 10.1.6.2

  2. Use the set ip vrf vrf-namenext-hop IP-address [...ip-address] command to apply policy-based routing to a VRF interface.

    Example:

    Device(config-route-map)# set ip vrf myvrf next-hop 10.5.5.5

  3. Use the set ip precedence [number | name] command to set the precedence value in the IP header.

    Example:

    Device(config-route-map)# set ip precedence 5

    • 0—Routine

    • 1—Priority

    • 2—Immediate

    • 3—Flash

    • 4—Flash-override

    • 5—Critical

    • 6—Internet

    • 7—Network

Use the exit command to return to global configuration mode.
5.

Use the interfaceinterface-id command to enter interface configuration mode, and specify the interface to be configured.

Example:

Device(config)# interface gigabitethernet 1/1
6.

Use the ip policy route-mapmap-tag command to enable PBR on a Layer 3 interface, and identify the route map to use.

Example:

Device(config-if)# ip policy route-map pbr-map

You can configure only one route map on an interface. However, you can have multiple route map entries with different sequence numbers. These entries are evaluated in the order of sequence number until the first match. If there is no match, packets are routed as usual.

Use the exit command to return to global configuration mode.
7.

(Optional) Use the ip local policy route-map map-tag command to enable local PBR to perform policy-based routing on packets originating at the switch.

Example:

Device(config)# ip local policy route-map local-pbr

This applies only to packets generated by the switch, not incoming packets.

Use the end command to return to privileged EXEC mode.
8.

(Optional) Use the show commands to verify the configuration.

  1. Use the show route-map [map-name] command to view all the route maps configured or only the one specified to verify configuration.

    Example:

    Device# show route-map

  2. Use the show ip policy command to view policy route maps attached to the interface.

    Example:

    Device# show ip policy

  3. Use the show ip local policy command to view whether or not local policy routing is enabled and, if so, the route map being used.

    Example:

    Device# show ip local policy