Applying Ip-Acls - Cisco DS-C9216I-K9 Configuration Manual

Chapter 22 Configuring IP Services

Applying IP-ACLs

You can define IP-ACLs without applying them. However, the IP-ACLs will have no effect until they are
applied to the switch's interface.
Apply the IP-ACL on the interface closest to the source of the traffic.
Tip
When you are trying to block traffic from source to destination, you can apply an inbound IP-ACL to E0
on Switch 1 instead of an outbound list to E1 on Switch 3.
Figure 22-3
The access group controls access to an interface. Each interface can only be associated with one access
list per direction. The ingress direction can have a different ACL than the egress direction. The access
group becomes active on creation.
Tip We recommend creating all rules in an access list, before creating the access group that uses this access
-list.
If you create an access group before an access-list, all packets in that interface are dropped, because the
Caution
access list is empty.
The terms in, out, source, and destination are used as referenced by the switch.
•
The access-group configuration for the ingress traffic applies to both local and remote traffic.
•
The access-group configuration for the egress traffic applies only to local traffic.
Using the log-deny option at the end of the individual ACL entries shows the ACL number and whether
the packet was permitted or denied, in addition to port-specific information. This option causes an
information logging message about the packet that matches the dropped entry (or entries).
For the input ACL, the log displays the raw MAC information. The keyword "MAC=" does not refer to
showing an Ethernet MAC frame with MAC address information. It refers to the Layer 2 MAC-layer
information dumped to the log. For the output ACL, the raw Layer 2 information is not dumped to the
log.
OL-7753-01
Denying Traffic on the Inbound Interface
traffic
E0
source
Switch 1
In—Traffic that is arriving on the interface and which will go through the switch; the source would
be where it's been and the destination is where it's going (on the other side of the router).
Out—Traffic that has already been through the switch and is leaving the interface; the source would
be where it's been (on the other side of the router) and the destination is where it's going.
E1
Switch 2 Switch 3
Cisco MDS 9000 Fabric Manager Switch Configuration Guide
IP Access Control Lists
traffic
destination
22-7