Cisco Systems 3750E manual Vlan Maps and Router ACL Configuration Guidelines, 34-37

Chapter 34 Configuring Network Security with ACLs

Using VLAN Maps with Router ACLs

Note When you use router ACLs with VLAN maps, packets that require logging on the router ACLs are not logged if they are denied by a VLAN map.

If the VLAN map has a match clause for the type of packet (IP or MAC) and the packet does not match the type, the default is to drop the packet. If there is no match clause in the VLAN map, and no action specified, the packet is forwarded if it does not match any VLAN map entry.

These sections contain information about using VLAN maps with router ACLs:

•VLAN Maps and Router ACL Configuration Guidelines, page 34-37

•Examples of Router ACLs and VLAN Maps Applied to VLANs, page 34-38

VLAN Maps and Router ACL Configuration Guidelines

These guidelines are for configurations where you need to have an router ACL and a VLAN map on the same VLAN. These guidelines do not apply to configurations where you are mapping router ACLs and VLAN maps on different VLANs.

The switch hardware provides one lookup for security ACLs for each direction (input and output); therefore, you must merge a router ACL and a VLAN map when they are configured on the same VLAN. Merging the router ACL with the VLAN map might significantly increase the number of ACEs.

If you must configure a router ACL and a VLAN map on the same VLAN, use these guidelines for both router ACL and VLAN map configuration:

•You can configure only one VLAN map and one router ACL in each direction (input/output) on a VLAN interface.

•Whenever possible, try to write the ACL with all entries having a single action except for the final, default action of the other type. That is, write the ACL using one of these two forms:

permit...

permit...

permit...

deny ip any any or

deny...

deny...

deny...

permit ip any any

•To define multiple actions in an ACL (permit, deny), group each action type together to reduce the number of entries.

•Avoid including Layer 4 information in an ACL; adding this information complicates the merging process. The best merge results are obtained if the ACLs are filtered based on IP addresses (source and destination) and not on the full flow (source IP address, destination IP address, protocol, and protocol ports). It is also helpful to use don’t care bits in the IP address, whenever possible.

If you need to specify the full-flow mode and the ACL contains both IP ACEs and TCP/UDP/ICMP ACEs with Layer 4 information, put the Layer 4 ACEs at the end of the list. This gives priority to the filtering of traffic based on IP addresses.

	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
OL-9775-02		34-37