Cisco Systems 3130 Router ACLs

34-4
Cisco Catalyst Blade Switch 3130 for Dell Software Configuration Guide
OL-13270-01
Chapter34 Configuring Network Security with ACLs
Understanding ACLs
Figure34-1 Using ACLs to Control Traffic to a Network
When you apply a port ACL to a trunk port, the ACL filters traffic on all VLANs present on the trunk
port. When you apply a port ACL to a port with voice VLAN, the ACL filters traffic on both da ta and
voice VLANs.
With port ACLs, you can filter IP traffic by using IP access lists and non-IP traffic by using MAC
addresses. You can filter both IP and non-IP traff ic on the same Lay er 2 interf ace by a pplying both an IP
access list and a MAC access list to the interface.
Note You cannot apply more than one IP access list and one MAC access list to a Layer 2 interfac e. I f an I P
access list or MAC access list is already configur ed on a Lay er 2 inter face and you a pply a new IP access
list or MAC access list to the interface, the new ACL replaces the previously configured one.
Router ACLs
You can apply router ACLs on switch virtual interfaces (SVIs), wh ich are Layer 3 inter fa ces to VLANs;
on physical Layer 3 interfaces; and on Layer 3 EtherChannel interfaces. You apply router ACLs on
interfaces for specific directions (inbound or outbound). You can apply one router ACL in each direction
on an interface.
One ACL can be used with multiple features for a given interface, and one feature can use multiple
ACLs. When a single router ACL is used by multiple features, it is examined multiple times.
The switch supports these access lists for IPv4 traffic:
•Standard IP access lists use source addresses for matching operations.
•Extended IP access lists use source and destination addresses and optional protocol type information
for matching operations.
Blade Server A
Blade Server B
119651
Research &
Development
network
= ACL denying traffic from
Blade Server B
and permitting traffic from
Blade Server A
= Packet
Human
Resources
network