Vlan Maps; Handling Fragmented And Unfragmented Traffic - Cisco 3020 - Catalyst Blade Switch Configuration Manual

Understanding ACLs
You cannot apply more than one IP access list and one MAC access list to a Layer 2 interface. If an IP
Note
access list or MAC access list is already configured on a Layer 2 interface and you apply a new IP access
list or MAC access list to the interface, the new ACL replaces the previously configured one.

VLAN Maps

You use VLAN ACLs or VLAN maps to filter traffic between devices in the same VLAN. When a VLAN
map is applied to a VLAN, all packets being forwarded in the VLAN are checked against the VLAN map.
Use VLAN maps for security packet filtering. VLAN maps are not defined by direction (input or output).
You can configure VLAN maps to match Layer 3 addresses for IPv4 traffic.
All non-IP protocols are access-controlled through MAC addresses and Ethertype using MAC VLAN
maps. (IP traffic is not access controlled by MAC VLAN maps.) You can enforce VLAN maps only on
packets going through the switch; you cannot enforce VLAN maps on traffic between hosts on a hub or
on another switch connected to this switch.
With VLAN maps, forwarding of packets is permitted or denied, based on the action specified in the
map.
VLAN 10 from being forwarded. You can apply only one VLAN map to a VLAN.
Figure 26-2
Blade Server A
(VLAN 10)

Handling Fragmented and Unfragmented Traffic

IP packets can be fragmented as they cross the network. When this happens, only the fragment
containing the beginning of the packet contains the Layer 4 information, such as TCP or UDP port
numbers, ICMP type and code, and so on. All other fragments are missing this information.
Some ACEs do not check Layer 4 information and therefore can be applied to all packet fragments. ACEs
that do test Layer 4 information cannot be applied in the standard manner to most of the fragments in a
fragmented IP packet. When the fragment contains no Layer 4 information and the ACE tests some
Layer 4 information, the matching rules are modified:
•
•
Cisco Catalyst Blade Switch 3020 for HP Software Configuration Guide
26-4
Figure 26-2 shows how a VLAN map is applied to prevent a specific type of traffic from Host A in
Using VLAN Maps to Control Traffic
= VLAN map denying specific type
of traffic from Host A
= Packet
Permit ACEs that check the Layer 3 information in the fragment (including protocol type, such as
TCP, UDP, and so on) are considered to match the fragment regardless of what the missing Layer 4
information might have been.
Deny ACEs that check Layer 4 information never match a fragment unless the fragment contains
Layer 4 information.
Chapter 26 Configuring Network Security with ACLs
Blade Server B
(VLAN 10)
OL-8915-01