How does L2 Access Switch process DACLs pushed by ISE?

[SIMMN]

I have not touched ISE or 802.1x auth for a while now but simply can not figure out how does access layer switch handles the DACLs OR even just a manually defined ACL for the port...

Say I have a C9500 as the core and C9200 as the access layer and use the ACL below as any example for this discussion. Once I associated the ACL with an access port (say Gi1/0/1) manually OR ACL got pushed down by ISE after user's authentication and authorization process on the port, how will the C9200 process the rules against user traffic? It is a l2 switch and has no concept of L3, right? Or it is still capable to check the IP headers with the TCP/UDP information of the traffic entering on the port even it is just a l2 switch?

permit tcp any host 192.168.100.200 eq 53

permit udp any host 192.168.100.200 eq 53

permit udp any host 192.168.100.200 eq ntp

deny ip any 192.168.0.0 0.0.255.255

permit ip any any

Thanks!

[Flavio Miranda · Accepted solution]

Hi

 This is indeed a great question!  

This is possible thanks to something called TCAM. Which is a special type of memory present on switches. Although some switches does not hold Layer 3 capability, they are able to process up layers thanks to the TCAM. 

Here in the blog there´s a interesting reading about this:

https://learningnetwork.cisco.com/s/article/tcam-demystified 

Enjoy!

[SIMMN]

Thanks for the information!