Configure Layer 2 And Layer 3 Acls; Using Acl Vlan Groups - Dell C9000 Series Networking Configuration Manual

Hide thumbs Also See for C9000 Series:

Table of Contents

Configure Layer 2 and Layer 3 ACLs

Both Layer 2 and Layer 3 ACLs may be configured on an interface in Layer 2 mode.

If both L2 and L3 ACLs are applied to an interface, the following rules apply:

When the system routes the packets, only the L3 ACL governs them because they are not filtered against

When the system switches the packets, first the L3 ACL filters them, then the L2 ACL filters them.

When the system switches the packets, the egress L3 ACL does not filter the packet.

For the following features, if you enable counters on rules that have already been configured and a new rule

is either inserted or prepended, all the existing counters are reset:

L2 ingress access list

L3 egress access list

L2 egress access list

If a rule is simply appended, existing counters are not affected.

Table 6. L2 and L3 Filtering on Switched Packets

L2 ACL Behavior

If you configure an interface as a vlan-stack access port, only the L2 ACL filters the packets. The L3

ACL applied to such a port does not affect traffic. That is, existing rules for other features (such as trace-

list, policy-based routing [PBR], and QoS) are applied to the permitted traffic.

For information about MAC ACLs, refer to

Use an ACL VLAN group to optimize ACL CAM usage by minimizing the number of CAM entries when you

apply an egress IP ACL on the member interfaces of specified VLANs.

When you apply an ACL on individual VLANs, the amount of CAM space required increases greatly because

the ACL rules are saved for each VLAN ID. To avoid excessive use of the CAM space, you can configure ACL

VLAN groups to combine all VLANs on which ACL filtering criteria is applied in a single class ID instead of

multiple VLAN IDs.

CAM optimization applies only when you use an ACL VLAN group; it does not apply if you apply an

ACL on individual VLANs.

L3 ACL Behavior

Decision on Targeted Traffic

L3 ACL denies.

L3 ACL permits.

L3 ACL denies.

L3 ACL permits.

Access Control Lists (ACLs)