VACL on 3750

[cisco_lite]

VLAN on 3750 has 5 ports/hosts assigned to 10.10.10.x/24 network.

What would a simple VACL configuration be like where only ssh among the five ports/hosts is allowed.

[ohassairi · Accepted solution]

try the following:

(config)#ip access-list extended test

(config-ext-nacl)#permit tcp 10.10.10.0 0.0.0.255 any eq 22

then

(config)#vlan access-map tt 1

(config-access-map)# match ip address test

(config-access-map)# action forward

(config-access-map)# exit

(config)# vlan filter tt vlan-list 10.

i suppose your vlan has number 10.

Note: if you have a l3 interface for this vlan in your switch (interface vlan 10; ip address 10.10.10.1 255.255.255.0), the configuration will be more easy.

[cisco_lite]

I read thru some materials which say that VACL/VLAN access-map is applicable only to packets coming into or going outside the VLAN.

Is it correct, that VACL also applies to traffic within the VLAN also i.e. restrict/allow access to host on port 1 to another host on port 2 (in the same vlan).

Please confirm.

Thanks.

[JamesLuther]

The VACL will apply to traffic within the VLAN also. Check

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/vacl.html

"VACLs can provide access control for all packets that are bridged within a VLAN or that are routed into or out of a VLAN"

[cisco_lite]

When I include the following acl with action as forward, the access from 20.x to 20.x is blocked

Extended IP access list MYACL

10 permit tcp any 20.20.20.0 0.0.0.255 eq 1500

1500 is a tcp service which is running on 20.x network hosts. However, when I replace the acl with permit ip any any it goes through.

Do the ACL work differently with vlan filters. Why are all 20.x hosts blocked from 1500 with the above ACL.

[cisco_lite]

Ok. It has to be applied both ways.