Vlan Maps - Lenovo CN4093 Application Manual

VLAN Maps

© Copyright Lenovo 2015
A VLAN map (VMAP) is a type of Access Control List (ACL) that is applied to a
VLAN or VM group rather than to a switch port as with regular ACLs (see
Control Lists" on page
create traffic filtering and metering policies that are associated with a VM group
VLAN, allowing filters to follow VMs as they migrate between hypervisors.
VMAPs are configured using the following ISCLI configuration command path:
CN 4093(config)# access-control vmap <VMAP ID> ?
action Set filter action
egress-port Set to filter for packets egressing this port
ethernet Ethernet header options
ipv4 IP version 4 header options
meter ACL metering configuration
mirror Mirror options
packet-format Set to filter specific packet format types
re-mark ACL re-mark configuration
statistics Enable access control list statistics
tcp-udp TCP and UDP filtering options
Lenovo N/OS 8.3 supports up to 128 VMAPs. Individual VMAP filters are
configured in the same fashion as regular ACLs, except that VLANs cannot be
specified as a filtering criteria (unnecessary, since VMAPs are assigned to a specific
VLAN or associated with a VM group VLAN).
Once a VMAP filter is created, it can be assigned or removed using the following
commands:
 For regular VLANs, use config-vlan mode:
CN 4093(config)# vlan <VLAN ID>
CN 4093(config-vlan)# [no] vmap <VMAP ID> [intports| extports]
 For a VM group, use the global configuration mode:
CN 4093(config)# [no] virt vmgroup <ID> vmap <VMAP ID>
[intports|extports]
Note: Each VMAP can be assigned to only one VLAN or VM group. However,
each VLAN or VM group may have multiple VMAPs assigned to it.
The optional intports or extports parameter can be specified to apply the
action (to add or remove the VMAP) for either the internal ports or external ports
only. If omitted, the operation will be applied to all ports in the associated VLAN
or VM group.
Note: VMAPs have a lower priority than port-based ACLs. If both an ACL and a
VMAP match a particular packet, both filter actions will be applied as long as there
is no conflict. In the event of a conflict, the port ACL will take priority, though
switch statistics will count matches for both the ACL and VMAP.
103). In a virtualized environment, VMAPs allow you to
"Access
271
Chapter 16: VMready