需求：
分支机构地址访问222不需要经过防火墙
Intenet地址访问222需要经过防火墙
Intenet地址访问除222之外的所有地址，不需要经过防火墙

配置：
7609:
int vlan 4
ip add 10.0.0.1 255.255.255.252
ip policy route-map cdnfirewall 
int g9/9
no ip add
swi acc vlan 4

int vlan 83
ip add 111.0.0.1

vlan 54
ip add 222.0.0.2 255.255.255.252
int g9/4
no ip add 
swi acc vlan 54 

ip route 0.0.0.0 0.0.0.0 10.0.0.2
ip route 222.0.0.0 0.0.0.0 222.0.0.255

ip access-list extended noneedfirewall
5 permit ip 1.0.0.0 0.0.0.255 222.0.0.0 0.0.0.63

int vlan 4
ip policy route-map cdnfirewall
route-map cdnfirewall permit 10
match ip address noneedfirewall
set ip default next-hop  

4507:
int vlan 54
ip add 222.0.0.1 255.255.255.0 
int g4/4
no ip add
swi acc vlan 54

如果静态路由 ip route 222.0.0.0 0.0.0.0 222.0.0.255，改为 ip route 222.0.0.0 0.0.0.0 222.0.0.1，那么
就要新增acl
ip access-list extended needfirewall
5 permit ip any 222.0.0.0 0.0.0.63 

新增police
int vlan 4
ip policy route-map cdnfirewall
route-map cdnfirewall permit 10
match ip address noneedfirewall
set ip default next-hop   
route-map cdnfirewall permit 20 
set ip  next-hop 222.0.0.0.255