Solved: VACL don't work at all

Boris Krajnc · ‎04-03-2013

Hello. I have switch Cisco 3560 and I would like to filter multicast traffic. Short explanation. This are multicast addresses from provider on VLAN 888 :

239.5.0.19:5000

239.5.0.26:5000

239.5.0.0:5000

239.5.0.1:5000

239.5.0.8:5000

239.5.0.10:5000

239.5.0.16:5000

239.5.0.3:5000

239.5.0.2 :5000

239.5.0.14:5000

239.5.0.28:5000

239.5.0.5:5000

239.5.0.27:5000

239.5.0.29:5000

239.3.0.19:5000

239.3.0.21:5000

239.3.0.27:5000

I write two access list:

ip access-list extended Streamfrom888

permit udp host 239.5.0.19 eq 5000 any

permit udp host 239.5.0.26 eq 5000 any

permit udp host 239.5.0.0 eq 5000 any

permit udp host 239.5.0.1 eq 5000 any

permit udp host 239.5.0.8 eq 5000 any

permit udp host 239.5.0.10 eq 5000 any

permit udp host 239.5.0.16 eq 5000 any

permit udp host 239.5.0.3 eq 5000 any

permit udp host 239.5.0.2 eq 5000 any

ip access-list extended Stream_from_888

permit udp any any

This is my configuration :

vlan access-map Stream_from_888 10

action drop

match ip address Streamfrom888

vlan access-map Stream_from_888 20

action forward

match ip address Stream_from_888

vlan filter Stream_from_888 vlan-list 888

I expect that streams from acl Streamfrom888 will be dropped and the rest of streams will be forwarded. Unfortunately traffic from all streams passs through.

Can anybody help me and tell what I don't understand how to configure VACL or where in my configuration is mistake?

Best regards

Boris

gkeshishian · ‎04-03-2013

Mult-cast addresses are destinations correct? Your filter is looking at them as a source address.

View solution in original post

alex-shpil · ‎04-03-2013

Hi Boris,

Multicast traffic is beeing sent to multicast destination ip address.

On you ACL it configured as source.

Try to configure the ACL like this:

permit udp any host 239.5.0.19 eq 5000

permit udp any host 239.5.0.26 eq 5000

.

etc.

BR,

View solution in original post

gkeshishian · ‎04-03-2013

Mult-cast addresses are destinations correct? Your filter is looking at them as a source address.

Boris Krajnc · ‎04-03-2013

I am sorry but I don't understant your question where you say "... if addressess are destinations correct". In acl I define source as host and destination any. In filter I add name of access-map.

alex-shpil · ‎04-03-2013

In your ACL multicast are the source addresses, it's not making sence.

You need to configure any as source and the multicast addresses as detinations.

alex-shpil · ‎04-03-2013

Hi Boris,

Multicast traffic is beeing sent to multicast destination ip address.

On you ACL it configured as source.

Try to configure the ACL like this:

permit udp any host 239.5.0.19 eq 5000

permit udp any host 239.5.0.26 eq 5000

.

etc.

BR,

Boris Krajnc · ‎04-04-2013

Guys, it works now, and yes, I understand now where I made mistake. I would like to thank you for fast response and right answers.

Many, many thanks ....

Here is also my example if will anybody need how to :

This are all incoming streams :

permit udp any host 239.5.1.19 eq 5000

permit udp any host 239.5.1.26 eq 5000

permit udp any host 239.5.1.0 eq 5000

permit udp any host 239.5.1.1 eq 5000

permit udp any host 239.5.1.8 eq 5000

permit udp any host 239.5.1.10 eq 5000

permit udp any host 239.5.1.16 eq 5000

permit udp any host 239.5.1.3 eq 5000

permit udp any host 239.5.1.2 eq 5000

permit udp any host 239.5.1.14 eq 5000

permit udp any host 239.5.1.28 eq 5000

permit udp any host 239.5.1.5 eq 5000

permit udp any host 239.5.1.27 eq 5000

permit udp any host 239.5.1.29 eq 5000

permit udp any host 239.3.1.19 eq 5000

permit udp any host 239.3.1.21 eq 5000

permit udp any host 239.3.1.27 eq 5000

permit udp any host 239.3.1.20 eq 5000

permit udp any host 239.4.1.0 eq 5000

permit udp any host 239.4.1.1 eq 5000

permit udp any host 239.6.1.18 eq 5000

permit udp any host 239.8.1.13 eq 5000

This streams will pass: