Access Control Entries; Acl Supported Types; Supported Acls; Acl Precedence - Cisco Catalyst 2960-X Security Configuration Manual

Supported ACLs

traffic are forwarded or blocked at router interfaces. For example, you can allow e-mail traffic to be forwarded
but not Telnet traffic. ACLs can be configured to block inbound traffic, outbound traffic, or both.

Access Control Entries

An ACL contains an ordered list of access control entries (ACEs). Each ACE specifies permit or deny and a
set of conditions the packet must satisfy in order to match the ACE. The meaning of permit or deny depends
on the context in which the ACL is used.

ACL Supported Types

The switch supports IP ACLs and Ethernet (MAC) ACLs:
• IP ACLs filter IPv4 traffic, including TCP, User Datagram Protocol (UDP), Internet Group Management
• Ethernet ACLs filter non-IP traffic.
This switch also supports quality of service (QoS) classification ACLs.
Supported ACLs
The switch supports three types of ACLs to filter traffic:
• Port ACLs access-control traffic entering a Layer 2 interface. You can apply only one IP access list and
• Router ACLs access-control routed traffic between VLANs and are applied to Layer 3 interfaces in a
• VLAN ACLs or VLAN maps access-control all packets (bridged and routed). You can use VLAN maps

ACL Precedence

When VLAN maps, Port ACLs, and router ACLs are configured on the same switch, the filtering precedence,
from greatest to least for ingress traffic is port ACL, VLAN map, and then router ACL. For egress traffic, the
filtering precedence is router ACL, VLAN map, and then port ACL.
The following examples describe simple use cases:
• When both an input port ACL and a VLAN map are applied, incoming packets received on ports with
• When an input router ACL and input port ACL exist in a switch virtual interface (SVI), incoming packets
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
142
Protocol (IGMP), and Internet Control Message Protocol (ICMP).
one MAC access list to a Layer 2 interface.
specific direction (inbound or outbound).
to filter traffic between devices in the same VLAN. VLAN maps are configured to provide access control
based on Layer 3 addresses for IPv4. Unsupported protocols are access-controlled through MAC addresses
using Ethernet ACEs. After a VLAN map is applied to a VLAN, all packets (routed or bridged) entering
the VLAN are checked against the VLAN map. Packets can either enter the VLAN through a switch
port or through a routed port after being routed.
a port ACL applied are filtered by the port ACL. Other packets are filtered by the VLAN map
received on ports to which a port ACL is applied are filtered by the port ACL. Incoming routed IP packets
received on other ports are filtered by the router ACL. Other packets are not filtered.
Configuring IPv4 ACLs
OL-29048-01