Cisco Systems 3750E manual 34-33

Chapter 34 Configuring Network Security with ACLs

Configuring VLAN Maps

Example 3

In this example, the VLAN map has a default action of drop for MAC packets and a default action of forward for IP packets. Used with MAC extended access lists good-hostsand good-protocols, the map will have the following results:

•Forward MAC packets from hosts 0000.0c00.0111 and 0000.0c00.0211

•Forward MAC packets with decnet-iv or vines-ip protocols

•Drop all other non-IP packets

•Forward all IP packets

Switch(config)# mac access-list	extended good-hosts
Switch(config-ext-macl)# permit	host 000.0c00.0111 any
Switch(config-ext-macl)# permit	host 000.0c00.0211 any
Switch(config-ext-nacl)# exit
Switch(config)# mac access-list	extended good-protocols
Switch(config-ext-macl)# permit	any any decnet-ip
Switch(config-ext-macl)# permit	any any vines-ip
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map	drop-mac-default 10

Switch(config-access-map)#match mac address good-hosts

Switch(config-access-map)# action forward

Switch(config-access-map)# exit

Switch(config)# vlan access-map drop-mac-default 20

Switch(config-access-map)#match mac address good-protocols

Switch(config-access-map)# action forward

Example 4

In this example, the VLAN access lists tcp-matchand

map has a default action of drop for all packets (IP and non-IP). Used with good-hostsfrom Examples 2 and 3, the map will have the following results:

•Forward all TCP packets

•Forward MAC packets from hosts 0000.0c00.0111 and 0000.0c00.0211

•Drop all other IP packets

•Drop all other MAC packets

Switch(config)# vlan access-map drop-all-default 10

Switch(config-access-map)# match ip address tcp-match

Switch(config-access-map)# action forward

Switch(config-access-map)# exit

Switch(config)# vlan access-map drop-all-default 20

Switch(config-access-map)#match mac address good-hosts

Switch(config-access-map)# action forward

	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02		34-33