Question for rduconsulting ... Ip route Statements

No, not ok,

All traffic destined for networks not explicity in the routing table via specific route entries  will be routed to 10.170.0.254.

All traffic destined for subnet 172.27.0.0/16 will be routed to 172.27.0.254. However, you have directly connected networks in 172.27.0.0/16 (SVI's 15-19) this will overide the static route, these are connected interfaces. What networks are behind 172.27.0.254 that you need to route to? Whatever they are you need to be more specific in your route statements to route to them. in other words the 172.27.0.0/16 is too large.

harbor235 ;}

ip route 172.27.0.0 /17 network is the largest ... see the above vlans

Thats fine, the more specific route if it exists will take precedence, it depends where you are routing to.
All I am saying is that some of the SVI's will be the preferred path if the destination is within that interface
range.

Are you trying to configure routing to a destination via the ip route commands or do you want to route traffic
sourced from those networks to a particular gateway?

example; you want to route to 172.27.192.5, this will not route to 172.27.0.254 it will go to SVI vlan18 because
he has a directly connected interface in that range, period.

Your static needs to be more specific, all 172.27.0.0/16 traffic will not goto 172.27.0.254. What networks are available behing 172.27.0.254 that you want to get to?

It would be better to set up dynamic routing and simplify as much as possible

harbor235 ;}

Since we don't have a physical separation between the DMZ  and internal networks , I want to make sure that servers in DMZ web  on 172.27.2.x don't access the db servers on 10.170.5.x. I know acls are require but in a way I want to force the fw to act as the routing

By the way the sup card only does basic  layer 3 ( no routing like ospf)

do you want to route traffic
sourced from those networks to a particular gateway?
Yes ...I want the to go out the Netscreen ISG1000 interface 172.27.0.254

I thought of using the following on the switch. This should work

access-list 1 permit 172.27.0 0 0.0.255.255

interface Vlan 15
ip policy route-map DMZ
ip route-cache policy

route-map DMZ permit 10
match ip address 1
set ip next-hop 172.27.0.254

i tried the the source base and i still see that tracert hits the following

172.27.0.2
10.170.0.254

If the source of the traffic is in vlan15 use the following for access-list 1;

access-list 1 permit 172.27.0.0 0.0.128.255 since vlan 15 has an ip of

172.27.0.2/17

harbor235 ;}

thats what it i did but cisco says access-list 1 permit 172.27.0.0 0.0.128.255 should be access-list 1 permit 172.27.0.0 0.0.127.255 or do an extended access-list 101 ip permit 172.27.0.0 0.0.127. .255 any . None of the solutions when doing an tracert go thru 172.27.0.254 ... They are looking into to it.

Oh, you may have to do a extended traceroute and pick the vlan15 interface as the source. Its like extended ping.

enter traceroute, then hit enter, go through the interactive text and ping source vlan15 interface and the destination you want.

harbor235 ;}