VACL or SVI AVL

[nir.fisher]

hi

could someone explain what is the difference between applying an ACL to an SVI on a switch or applying a VACL to a vlan?

thanks

[rtjensen4]

You apply an ACL to the SVI to control how traffic is routedBETWEEN VLANs on an L3 switch. An ACL applied to an SVI does nothing to control the traffic on the VLAN itself. The VLAN will carry whatever traffic is passed to it, with not filtering happening until it's routed.

Example:

This would deny any TCP traffic from VLAN1 to VLAN2

interface vlan1

ip address 192.168.1.1 255.255.255.0

access-group 1 in

!

interface vlan2

ip address 192.168.2.1 255.255.255.0

access-list 1 deny tcp any 192.168.2.0 0.0.0.255

The VACL is applied to a VLAN to control traffic WITHIN a VLAN. Ordinarily, you can't stop Host1 from talking to Host2 if they're connected to the same switch in the same VLAN. If they were in seperate VLANs, you could apply an ACL to the SVI to do it, but on the same VLAN, there's no filtering. This is where the VACL comes into play. The VACL applies to traffic in the VLAN. You can use a regular access-list or a mac-address access-list for this.

Example:

This would deny traffic destined to port 80 on vlan 1

vlan access-map test1 10
action drop
match ip address 110

!

access-list 110 permit tcp any any eq 80

!

vlan filter test1 vlan 1

HTH

Ryan

[nir.fisher]

thanks , excellent stuff !!

youv' been allot of help

another question, if I apply a VACL to deny traffic to a certain host would that effect traffic coming to that host from a different vlan as well as

traffic from same vlan ?

[cadet alain]

Hi,

VACL is  for intra VLAN traffic otherwise you use a RACL.

Regards.

[nir.fisher]

thanks , but you didnt answer my question , would inter-vlan traffic to a certain host  be effected by an intra-vlan ACL regarding that host ?

[Jon Marshall]

nir.fisher wrote:
thanks , excellent stuff !!
youv' been allot of help
another question, if I apply a VACL to deny traffic to a certain host would that effect traffic coming to that host from a different vlan as well as
traffic from same vlan ?

Yes it would. A VACL applies to to all traffic within that vlan. Once the traffic is routed onto that vlan then the VACL will be applied.

Jon

[nir.fisher]

thanks for all the help