Cisco Catalyst 4500 Series Configuration Manual page 1236
Release ios xe 3.3.0sg and ios 15.1(1)sg
Hide thumbs
Also See for Catalyst 4500 Series:
- Software configuration manual (2086 pages) ,
- Administration manual (1814 pages) ,
- Configuration manual (1254 pages)
Table of Contents
Advertisement
Configuring VLAN Maps
Switch(config)# ip access-list extended ip1
Switch(config-ext-nacl)# permit tcp any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map map_1 10
Switch(config-access-map)# match ip address ip1
Switch(config-access-map)# action drop
This example shows how to create a VLAN map to permit a packet. ACL ip2 permits UDP packets; and
any packets that match the ip2 ACL are forwarded.
Switch(config)# ip access-list extended ip2
Switch(config-ext-nacl)# permit udp any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map map_1 20
Switch(config-access-map)# match ip address ip2
Switch(config-access-map)# action forward
In this map, any IP packets that did not match any of the previous ACLs (that is, packets that are not TCP
packets or UDP packets) would get dropped.
Example 2
In this example, the VLAN map is configured to drop IP packets and to forward MAC packets by default.
By applying standard ACL 101 and the extended named access lists igmp-match and tcp-match, the
VLAN map is configured to do the following:
•
•
•
•
•
Switch(config)# access-list 101 permit udp any any
Switch(config)# ip access-list extended igmp-match
Switch(config-ext-nacl)# permit igmp any any
Switch(config)# ip access-list extended tcp-match
Switch(config-ext-nacl)# permit tcp any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map drop-ip-default 10
Switch(config-access-map)# match ip address 101
Switch(config-access-map)# action forward
Switch(config-access-map)# exit
Switch(config)# vlan access-map drop-ip-default 20
Switch(config-access-map)# match ip address igmp-match
Switch(config-access-map)# action drop
Switch(config-access-map)# exit
Switch(config)# vlan access-map drop-ip-default 30
Switch(config-access-map)# match ip address tcp-match
Switch(config-access-map)# action forward
Example 3
In this example, the VLAN map is configured to drop MAC packets and forward IP packets by default.
By applying MAC extended access lists, good-hosts and good-protocols, the VLAN map is configured
to do the following:
•
•
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
51-20
Forward all UDP packets
Drop all IGMP packets
Forward all TCP packets
Drop all other IP packets
Forward all non-IP packets
Forward MAC packets from hosts 0000.0c00.0111 and 0000.0c00.0211
Forward MAC packets of DECnet or VINES (Virtual Integrated Network Service) protocol-family
Chapter 51
Configuring Network Security with ACLs
OL-25340-01
- Quick Links:
- Resetting a Switch to Factory Default...
Hide quick links:
Advertisement
Chapters
Table of Contents
Troubleshooting
