Using Vlan Maps With Router Acls; Guidelines - Cisco WS-C3560-48PS-S Software Configuration Manual

Software configuration guide

Hide thumbs Also See for WS-C3560-48PS-S:

Table of Contents

Using VLAN Maps with Router ACLs

To access control both bridged and routed traffic, you can use VLAN maps only or a combination of

router ACLs and VLAN maps. You can define router ACLs on both input and output routed VLAN

interfaces, and you can define a VLAN map to access control the bridged traffic.

If a packet flow matches a VLAN-map deny clause in the ACL, regardless of the router ACL

configuration, the packet flow is denied.

When you use router ACLs with VLAN maps, packets that require logging on the router ACLs are not

logged if they are denied by a VLAN map.

If the VLAN map has a match clause for the type of packet (IP or MAC) and the packet does not match

the type, the default is to drop the packet. If there is no match clause in the VLAN map, and no action

specified, the packet is forwarded if it does not match any VLAN map entry.

This section includes this information about using VLAN maps with router ACLs:

These guidelines are for configurations where you need to have an router ACL and a VLAN map on the

same VLAN. These guidelines do not apply to configurations where you are mapping router ACLs and

VLAN maps on different VLANs.

The switch hardware provides one lookup for security ACLs for each direction (input and output);

therefore, you must merge a router ACL and a VLAN map when they are configured on the same VLAN.

Merging the router ACL with the VLAN map might significantly increase the number of ACEs.

If you must configure a router ACL and a VLAN map on the same VLAN, use these guidelines for both

router ACL and VLAN map configuration:

Catalyst 3560 Switch Software Configuration Guide

Guidelines, page 27-36

Examples of Router ACLs and VLAN Maps Applied to VLANs, page 27-37

You can configure only one VLAN map and one router ACL in each direction (input/output) on a

VLAN interface.

Whenever possible, try to write the ACL with all entries having a single action except for the final,

default action of the other type. That is, write the ACL using one of these two forms:

deny ip any any

permit ip any any

Configuring Network Security with ACLs

Show Quick Links

Table of Contents