Examples Of Router Acls And Vlan Maps Applied To Vlans - Cisco Catalyst 3550 series Software Configuration Manual

Chapter 28 Configuring Network Security with ACLs
•
After the ACL configuration is stable for a specified interval, the system loads the configuration into
Note
hardware. Forwarding is blocked on any affected interfaces while the hardware is being updated. To
change this behavior, you can use the mls aclmerge delay and the access-list hardware program
nonblocking global configuration commands. Refer to the command reference for this release for
descriptions of these commands.

Examples of Router ACLs and VLAN Maps Applied to VLANs

This section gives examples of applying router ACLs and VLAN maps to a VLAN for switched, bridged,
routed, and multicast packets. Although the following illustrations show packets being forwarded to their
destination, each time the packet's path crosses a line indicating a VLAN map or an ACL, it is also
possible that the packet might be dropped, rather than forwarded.
ACLs and Switched Packets
Figure 28-6
switched within the VLAN without being routed or forwarded by fallback bridging are only subject to
the VLAN map of the input VLAN.
Figure 28-6 Applying ACLs on Switched Packets
Host A
(VLAN 10)
78-11194-09
Avoid including Layer 4 information in an ACL; adding this information complicates the merging
process. The best merge results are obtained if the ACLs are filtered based on IP addresses (source
and destination) and not on the full flow (source IP address, destination IP address, protocol, and
protocol ports). It is also helpful to use don't care bits in the IP address, whenever possible.
If you need to specify the full-flow mode and the ACL contains both IP ACEs and TCP/UDP/ICMP
ACEs with Layer 4 information, put the Layer 4 ACEs at the end of the list. This gives priority to
the filtering of traffic based on IP addresses.
shows how an ACL is applied on packets that are switched within a VLAN. Packets
VLAN 10
map
Frame
Host C
(VLAN 10)
VLAN 10
Catalyst 3550 switch
Input Output
router router VLAN 20
ACL ACL
Routing function or
fallback bridge
Packet
Catalyst 3550 Multilayer Switch Software Configuration Guide
Using VLAN Maps with Router ACLs
map
VLAN 20
28-37