Mac Acls - Cisco Nexus 9000 Series Configuration Manual
Nx-os security configuration guide, release 9.x
Hide thumbs
Also See for Nexus 9000 Series:
- Configuration manual (276 pages) ,
- Troubleshooting manual (126 pages) ,
- Quick start configuration manual (6 pages)
Table of Contents
Advertisement
MAC ACLs
MAC ACLs
MAC ACLs are ACLs that filter traffic using the information in the Layer 2 header of each packet. Each rule
specifies a set of conditions that a packet must satisfy to match the rule. When the Cisco NX-OS software
determines that a MAC ACL applies to a packet, it tests the packet against the conditions of all rules. The
first match determines whether a packet is permitted or denied, or if there is no match, the Cisco NX-OS
software applies the applicable default rule. The Cisco NX-OS software continues processing packets that are
permitted and drops packets that are denied.
Related Topics
VACLs
A VLAN ACL (VACL) is one application of an IP ACL or MAC ACL. You can configure VACLs to apply
to all packets that are routed into or out of a VLAN or are bridged within a VLAN. VACLs are strictly for
security packet filtering and for redirecting traffic to specific physical interfaces. VACLs are not defined by
direction (ingress or egress).
Related Topics
DHCP Snooping
DHCP snooping acts like a firewall between untrusted hosts and trusted DHCP servers. DHCP snooping
performs the following activities:
• Validates DHCP messages received from untrusted sources and filters out invalid messages.
• Builds and maintains the DHCP snooping binding database, which contains information about untrusted
• Uses the DHCP snooping binding database to validate subsequent requests from untrusted hosts.
Dynamic ARP inspection (DAI) and IP Source Guard (IPSG) also use information stored in the DHCP snooping
binding database.
Dynamic ARP Inspection
Dynamic ARP inspection (DAI) ensures that only valid ARP requests and responses are relayed. When DAI
is enabled and properly configured, a Cisco NX-OS device performs these activities:
• Intercepts all ARP requests and responses on untrusted ports.
• Verifies that each of these intercepted packets has a valid IP-to-MAC address binding before updating
• Drops invalid ARP packets.
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
6
Configuring MAC ACLs
Configuring VLAN ACLs
hosts with leased IP addresses.
the local ARP cache or before forwarding the packet to the appropriate destination.
Overview
- Quick Links:
- Radius and Tacacs+ Security Protocols
Hide quick links:
Advertisement
Table of Contents
