Vacl Configuration Overview; Defining A Vlan Access Map - Cisco 7604 Configuration Manual
Ios software configuration guide
Hide thumbs
Also See for 7604:
- Configuration manual (742 pages) ,
- Installation manual (324 pages) ,
- User manual (98 pages)
Table of Contents
Advertisement
Chapter 35
Configuring VLAN ACLs
•
•
•
VACL Configuration Overview
VACLs use standard and extended Cisco IOS IP and IPX ACLs, and MAC Layer-named ACLs (see the
"Configuring MAC ACLs" section on page
VLAN access maps can be applied to VLANs or to WAN interfaces for VACL capture. VACLs attached
to WAN interfaces support only standard and extended Cisco IOS IP ACLs.
Each VLAN access map can consist of one or more map sequences, each sequence with a match clause
and an action clause. The match clause specifies IP, IPX, or MAC ACLs for traffic filtering and the action
clause specifies the action to be taken when a match occurs. When a flow matches a permit ACL entry,
the associated action is taken and the flow is not checked against the remaining sequences. When a flow
matches a deny ACL entry, it will be checked against the next ACL in the same sequence or the next
sequence. If a flow does not match any ACL entry and at least one ACL is configured for that packet
type, the packet is denied.
To use access control for both bridged and routed traffic, you can use VACLs alone or a combination of
VACLs and ACLs. You can define ACLs on the VLAN interfaces to use access control for both the input
and output routed traffic. You can define a VACL to use access control for the bridged traffic.
The following caveats apply to ACLs when used with VACLs:
•
•
The action clause in a VACL can be forward, drop, capture, or redirect. Traffic can also be logged.
VACLs applied to WAN interfaces do not support the redirect or log actions.
Note
•
•
•
Defining a VLAN Access Map
To define a VLAN access map, perform this task:
Command
Router(config)# vlan access-map map_name [0-65535]
OL-4266-08
Verifying VLAN Access Map Configuration, page 35-8
VLAN Access Map Configuration and Verification Examples, page 35-9
Configuring a Capture Port, page 35-9
Packets that require logging on the outbound ACLs are not logged if they are denied by a VACL.
VACLs are applied on packets before NAT translation. If the translated flow is not subject to access
control, the flow might be subject to access control after the translation because of the VACL
configuration.
VACLs have an implicit deny at the end of the map; a packet is denied if it does not match any ACL
entry, and at least one ACL is configured for the packet type.
If an empty or undefined ACL is specified in a VACL, any packets will match the ACL and the
associated action is taken.
VACLs cannot be applied to IGMP, MLD, or PIM traffic.
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
41-67) and VLAN access maps.
Purpose
Defines the VLAN access map. Optionally, you can specify
the VLAN access map sequence number.
Configuring VACLs
35-5
- Quick Links:
- Supported Hardware and Software
Hide quick links:
Advertisement
Chapters
Table of Contents
