VLAN ACL

[Khaleelur Rahman]

hi,

please let me know How to configure VLAN ACL (syntex)..?

Regards 

Khaleelur Rahman

[jbowman1985]

Hi Khaleelur,

There are two ways to configure VACLs: one using MAC access lists and the other using IP access lists.  One thing to remember MAC ACLs only work if the Ethertype field does not indicate IP or IPX.  

To configure an IP access list for a VACL you need to do the following:

1.  Configure and access list:

sw(config)# ip access-list standard 10

    permit 192.168.1.0 0.0.0.255

2. Create VLAN access map

sw(config#) vlan access-map access-map-name

sw(config-access-map)# match ip address 10 (acl-name from above)

sw(config-access-map)# action forward (this will forward traffic)

3.  Apply VLAN access map to VLAN

sw(config)# vlan filter access-map-name vlan-list 10,20,30 (Applies VACL to vlans 10,20 and 30)

Hope this helps!

[Khaleelur Rahman]

Dear Jbowman,

please let me know how to implement this ACL to the specific Vlan interface.

[Masoud Pourshabanian]

Hello,

VLAN access-list is for controlling access within a VLAN.  ACL is different. ACL is applied to layer three interfaces.

As an example,

Access-list 101 [permit/deny] [IP/TCP/UDP/ICMP,....] [source][source port][destination][destinatio port]

access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

interface vlan x

IP access-group 101 [in/out]

Let me know if you need an specific example.

Masoud

[Khaleelur Rahman]

hello Masoud ,

please let me know the example.

Regards,

Khaleel

[Masoud Pourshabanian]

Hello,

I am sorry, I was not clear. I meant I will give you an specific example if you give me a scenario. For example, give me the IP subnets or addresses you want to permit or deny.

Masoud

[jbowman1985]

To reitterate what Masoud wrote:  VACL is applied to the VLAN and not a specific interface.  VACL also applies to ingress and egress (in and out) traffic on an interface that is a member of the VLAN you applied the VACL to.

Example:

You applied a VACL to VLAN 10.  Let's say interface Fa0/1 is an access port in VLAN 10 and Gi0/1 is a trunk interface with VLAN 10.  

The VACL would apply to both interfaces.

It can get a little confusing because you do create an IP access list for the VACL, however, the VACL is not applied directly to an interface like an IP access list.  Hope this helps.

[paul driver]

Hello

VACLS - Restrict traffic ONLY WITHIN a specifc vlan  ------ Jbownam example

RACLS - Restrict traffic between vlans  - Masoud Pourshabanian example - 
IN -  ( from within the vlan)
OUT - (going into the vlan)


res
Paul