Supported Acls - Cisco Catalyst 2975 Software Configuration Manual

Understanding ACLs
An ACL contains an ordered list of access control entries (ACEs). Each ACE specifies permit or deny
and a set of conditions the packet must satisfy in order to match the ACE. The meaning of permit or deny
depends on the context in which the ACL is used.
The switch supports IP ACLs and Ethernet (MAC) ACLs:
•
•
This switch also supports quality of service (QoS) classification ACLs. For more information, see the
"Classification Based on QoS ACLs" section on page
These sections contain this conceptual information:
•
•
•

Supported ACLs

•
•
Note
You can use input port ACLs and router ACLs on the same switch. However, a port ACL takes
precedence over a router ACL.
•
•
Catalyst 2975 Switch Software Configuration Guide
31-2
IP ACLs filter IPv4 traffic, including TCP, User Datagram Protocol (UDP), Internet Group
Management Protocol (IGMP), and Internet Control Message Protocol (ICMP).
Ethernet ACLs filter non-IP traffic.
Supported ACLs, page 31-2
Handling Fragmented and Unfragmented Traffic, page 31-4
ACLs and Switch Stacks, page 31-5
Port ACLs access-control traffic entering a Layer 2 interface. The switch does not support port ACLs
in the outbound direction. You can apply only one IP access list and one MAC access list to a Layer 2
interface. For more information, see the
Router ACLs access-control routed traffic between VLANs and are applied to Layer 3 interfaces in
a specific direction (inbound or outbound). For more information, see the
page 31-4.
Router ACLs are supported only on SVIs.
When an input router ACL and input port ACL exist in a switch virtual interface (SVI), incoming
packets received on ports to which a port ACL is applied are filtered by the port ACL. Incoming
routed IP packets received on other ports are filtered by the router ACL. Other packets are not
filtered.
When an output router ACL and input port ACL exist in an SVI, incoming packets received on the
ports to which a port ACL is applied are filtered by the port ACL. Outgoing routed IP packets are
filtered by the router ACL. Other packets are not filtered.
Chapter 31
33-8.
"Port ACLs" section on page
Configuring Network Security with ACLs
31-3.
"Router ACLs" section on
OL-19720-02