Configuring Vlan Maps - Cisco Catalyst 4500 Series Software Configuration Manual

Chapter 62 Configuring Network Security with ACLs
Output IPv6 ACLs with ACE to match on the ICMP option fail on a switch.
Note
The following conditions may cause a RACL to malfunction (no workaround):
•
•
The following examples of nonfunctioning RACLs:
IPv6 access list a1
IPv6 access list a2
permit icmp 2020::/96 any nd-ns sequence 10

Configuring VLAN Maps

This section includes these topics:
•
•
•
•
This section describes how to configure VLAN maps, which is the only way to control filtering within
a VLAN. VLAN maps have no direction. To filter traffic in a specific direction by using a VLAN map,
you need to include an ACL with specific source or destination addresses. If there is a match clause for
that type of packet (IP or MAC) in the VLAN map, the default action is to drop the packet if the packet
does not match any of the entries within the map. If there is no match clause for that type of packet, the
default is to forward the packet.
To create a VLAN map and apply it to one or more VLANs, follow these steps:
Create the standard or extended IP ACLs or named MAC extended ACLs that you want to apply to the
Step 1
VLAN.
Enter the vlan access-map global configuration command to create a VLAN ACL map entry.
Step 2
In access map configuration mode, you have the option to enter an action (forward [the default] or
drop) and enter the match command to specify an IP packet or a non-IP packet and to match the packet
against one or more ACLs (standard or extended). If a match clause is not specified, the action is applied
to all packets. The match clause can be used to match against multiple ACLs. If a packet matches any of
the specified ACLs, the action is applied.
Note
ACLs are applied on the output direction of the interface.
IPv6 ACL contain Ace to match on the ICMP option fields (ICMP Type or ICMP Code).
permit icmp any any nd-ns sequence 10
deny ipv6 any any sequence 20
deny ipv6 any any sequence 20
VLAN Map Configuration Guidelines, page 62-22
Creating and Deleting VLAN Maps, page 62-22
Applying a VLAN Map to a VLAN, page 62-25
Using VLAN Maps in Your Network, page 62-25
If the VLAN map has a match clause for the type of packet (IP or MAC) and the packet does not
match the type, the default is to drop the packet. If there is no match clause in the VLAN map
for that type of packet, and no action specified, the packet is forwarded.
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Configuring VLAN Maps
62-21