19-3
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-03
Chapter19 Configuring Network Securi ty with ACLs Understanding ACLs
One ACL can be used with multiple features for a given interface, and one feature can use multiple
ACLs. When a single router ACL is used by multiple features, it is examined multiple times.
•Standard IP access lists use source addresses for matching operations.
•Extended IP access lists use source and destination addresses and optional protocol type information
for matching operations.
The switch examines ACLs associated with features configured on a given inter face and a direction. As
packets enter the switch on an interface, ACLs associ ate d with a ll inbo und fea tu res c on fig ure d o n th at
interface are examined. After packets are routed and before they a re forwar ded to the next hop, a ll ACLs
associated with outbound features configured on the egress interface are examined.
ACLs permit or deny packet forwarding based on how the packe t mat ches the ent ries i n the A CL . For
example, you can use access lists to allow one host to access a part of a network, but prevent another
host from accessing the same part. In Figure 19-1, ACLs applied at the router input allow Host A to
access the Human Resources network, but prevent Host B from acc essin g th e sam e ne tw ork.
Figure19-1 Using ACLs to Control Traffic to a Network
VLAN Maps
VLAN maps can access-control all traffic. You can apply VLAN maps on the switch to all packets that
are routed into or out of a VLAN or are bridged w ith in a VL A N. V LA N ma ps are use d stric tly fo r
security packet filtering. Unlike router ACLs, VLAN maps are not defined by direction (input or output).
You can configure VLAN maps to match Layer 3 addresses for IP traffic. All non-IP p rotoc ols ar e
access-controlled through MAC addresses and Ethertype using MAC VLA N ma ps . ( IP t raffic is not
access controlled by MAC VLAN maps.) You can enforce VLAN maps only on packets goi ng thr ough
the switch; you cannot enforce VLAN maps on traffic between ho sts on a h ub or on a nother sw itch
connected to this switch.
Si Host A
Host B
53033
Research &
Development
network
= ACL denying traffic from Host B
and permitting traffic from Host A
= Packet
Catalyst 3550 switch
with enhanced
multilayer software
image
Human
Resources
network