Prerequisites For Configuring Ipv4 Access Control Lists - Cisco Catalyst 2960 series Configuration Manual

Prerequisites for Configuring IPv4 Access Control Lists

Prerequisites for Configuring IPv4 Access Control Lists
This section lists the prerequisites for configuring network security with access control lists (ACLs).
• On switches running the LAN base feature set, VLAN maps are not supported.
Restrictions for Configuring IPv4 Access Control Lists
General Network Security
The following are restrictions for configuring network security with ACLs:
• Not all commands that accept a numbered ACL accept a named ACL. ACLs for packet filters and route
• A standard ACL and an extended ACL cannot have the same name.
• Though visible in the command-line help strings, appletalk is not supported as a matching condition
IPv4 ACL Network Interfaces
The following restrictions apply to IPv4 ACLs to network interfaces:
• When controlling access to an interface, you can use a named or numbered ACL.
• If you apply an ACL to a Layer 2 interface that is a member of a VLAN, the Layer 2 (port) ACL takes
• If you apply an ACL to a Layer 3 interface and routing is not enabled on the switch, the ACL only filters
• You do not have to enable routing to apply ACLs to Layer 2 interfaces.
Note By default, the router sends Internet Control Message Protocol (ICMP) unreachable messages when a
packet is denied by an access group on a Layer 3 interface. These access-group denied packets are not
dropped in hardware but are bridged to the switch CPU so that it can generate the ICMP-unreachable
message. They do not generate ICMP unreachable messages. ICMP unreachable messages can be disabled
on router ACLs with the no ip unreachables interface command.
MAC ACLs on a Layer 2 Interface
After you create a MAC ACL, you can apply it to a Layer 2 interface to filter non-IP traffic coming in that
interface. When you apply the MAC ACL, consider these guidelines:
• You can apply no more than one IP access list and one MAC access list to the same Layer 2 interface.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1174
filters on interfaces can use a name. VLAN maps also accept a name.
for the deny and permit MAC access-list configuration mode commands.
precedence over an input Layer 3 ACL applied to the VLAN interface or a VLAN map applied to the
VLAN.
packets that are intended for the CPU, such as SNMP, Telnet, or web traffic.
The IP access list filters only IP packets, and the MAC access list filters non-IP packets.