Vlan Maps; Aces And Fragmented And Unfragmented Traffic - Cisco Catalyst 2960-X Security Configuration Manual

Configuring IPv4 ACLs
As with port ACLs, the switch examines ACLs associated with features configured on a given interface. As
packets enter the switch on an interface, ACLs associated with all inbound features configured on that interface
are examined. After packets are routed and before they are forwarded to the next hop, all ACLs associated
with outbound features configured on the egress interface are examined.
ACLs permit or deny packet forwarding based on how the packet matches the entries in the ACL, and can be
used to control access to a network or to part of a network.

VLAN Maps

VLAN ACLs or VLAN maps are used to control network traffic within a VLAN. You can apply VLAN maps
to all packets that are bridged within a VLAN in the switch or switch stack. VACLs are strictly for security
packet filtering and for redirecting traffic to specific physical interfaces. VACLs are not defined by direction
(ingress or egress).
All non-IP protocols are access-controlled through MAC addresses and Ethertype using MAC VLAN maps.
(IP traffic is not access controlled by MAC VLAN maps.) You can enforce VLAN maps only on packets
going through the switch; you cannot enforce VLAN maps on traffic between hosts on a hub or on another
switch connected to this switch.
With VLAN maps, forwarding of packets is permitted or denied, based on the action specified in the map.
This shows how a VLAN map is applied to prevent a specific type of traffic from Host A in VLAN 10 from
being forwarded. You can apply only one VLAN map to a VLAN.
Figure 5: Using VLAN Maps to Control Traffic

ACEs and Fragmented and Unfragmented Traffic

IP packets can be fragmented as they cross the network. When this happens, only the fragment containing the
beginning of the packet contains the Layer 4 information, such as TCP or UDP port numbers, ICMP type and
code, and so on. All other fragments are missing this information.
Some access control entries (ACEs) do not check Layer 4 information and therefore can be applied to all
packet fragments. ACEs that do test Layer 4 information cannot be applied in the standard manner to most
of the fragments in a fragmented IP packet. When the fragment contains no Layer 4 information and the ACE
tests some Layer 4 information, the matching rules are modified:
• Permit ACEs that check the Layer 3 information in the fragment (including protocol type, such as TCP,
OL-29048-01
UDP, and so on) are considered to match the fragment regardless of what the missing Layer 4 information
might have been.
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
ACEs and Fragmented and Unfragmented Traffic
145