Cisco Nexus 7000 Series Command Reference Manual page 446

ip port access-group
• Layer 3 Ethernet subinterfaces
• Layer 3 Ethernet port-channel interfaces and subinterfaces
• Tunnels
• Loopback interfaces
• Management interfaces
However, an ACL applied to a Layer 3 interface with the ip port access-group command is inactive unless
the port mode changes to access or trunk (Layer 2) mode. To apply an IPv4 ACL as a router ACL, use the ip
access-group command.
You can also apply an IPv4 ACL as a VLAN ACL. For more information, see the match (VLAN access-map)
command.
The device applies port ACLs to inbound traffic only. The device checks inbound packets against the rules
in the ACL. If the first matching rule permits the packet, the device continues to process the packet. If the
first matching rule denies the packet, the device drops the packet and returns an ICMP host-unreachable
message.
If you delete the specified ACL from the device without removing the ACL from an interface, the deleted
ACL does not affect traffic on the interface.
If MAC packet classification is enabled on a Layer 2 interface, you cannot use the ip port access-group
command on the interface.
This command does not require a license.
Examples
This example shows how to apply an IPv4 ACL named ip-acl-01 to Ethernet interface 2/1 as a port ACL:
switch# configure terminal
switch(config)# interface ethernet 2/1
switch(config-if)# ip port access-group ip-acl-01 in
This example shows how to remove an IPv4 ACL named ip-acl-01 from Ethernet interface 2/1:
switch# configure terminal
switch(config)# interface ethernet 2/1
switch(config-if)# no ip port access-group ip-acl-01 in
This example shows how to view the configuration of an Ethernet interface and the error message that appears
if you try to apply an IPv4 port ACL to the interface when MAC packet classification is enabled:
switch(config)# show running-config interface ethernet 2/3
!Command: show running-config interface Ethernet2/3
!Time: Wed Jun 24 13:06:49 2009
version 4.2(1)
interface Ethernet2/3
ip access-group ipacl in
mac port access-group macacl
switchport
mac packet-classify
switch(config)# interface ethernet 2/3
switch(config-if)# ip port access-group ipacl in
ERROR: The given policy cannot be applied as mac packet classification is enable
d on this port
switch(config-if)#
Cisco Nexus 7000 Series Security Command Reference
420
I Commands