Examples Of Router Acls And Vlan Maps Applied To Vlans - Cisco Catalyst 3560-X Software Configuration Manual

Hide thumbs Also See for Catalyst 3560-X:

Table of Contents

Configuring Network Security with ACLs

If you must configure a router ACL and a VLAN map on the same VLAN, use these guidelines for both

router ACL and VLAN map configuration:

Examples of Router ACLs and VLAN Maps Applied to VLANs

This section gives examples of applying router ACLs and VLAN maps to a VLAN for switched, bridged,

routed, and multicast packets. Although the following illustrations show packets being forwarded to their

destination, each time the packet's path crosses a line indicating a VLAN map or an ACL, it is also

possible that the packet might be dropped, rather than forwarded.

ACLs and Switched Packets

within the VLAN without being routed or forwarded by fallback bridging are only subject to the VLAN

map of the input VLAN.

You can configure only one VLAN map and one router ACL in each direction (input/output) on a

VLAN interface.

Whenever possible, try to write the ACL with all entries having a single action except for the final,

default action of the other type. That is, write the ACL using one of these two forms:

deny ip any any

permit ip any any

To define multiple actions in an ACL (permit, deny), group each action type together to reduce the

number of entries.

Avoid including Layer 4 information in an ACL; adding this information complicates the merging

process. The best merge results are obtained if the ACLs are filtered based on IP addresses (source

and destination) and not on the full flow (source IP address, destination IP address, protocol, and

protocol ports). It is also helpful to use don't care bits in the IP address, whenever possible.

If you need to specify the full-flow mode and the ACL contains both IP ACEs and TCP/UDP/ICMP

ACEs with Layer 4 information, put the Layer 4 ACEs at the end of the list. This gives priority to

the filtering of traffic based on IP addresses.

ACLs and Switched Packets, page 1-41

ACLs and Bridged Packets, page 1-42

ACLs and Routed Packets, page 1-43

ACLs and Multicast Packets, page 1-43

shows how an ACL is applied on packets that are switched within a VLAN. Packets switched

Catalyst 3750-X and 3560-X Switch Software Configuration Guide

Using VLAN Maps with Router ACLs

Catalyst 3750-x