Cisco Systems 4500 About ACLs

47-2
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs
About ACLs
• Using VLAN Maps with Router ACLs, page 47-32
• Configuring PACLs, page 47-35
• Using PACL with VLAN Maps and Router ACLs, page 47-41
• Configuring RA Guard, page 47-43
Note The following discussions applies to both Supervisor Engine 6-E (and 6L-E) and non-Supervisor Engine
6-E (and 6L-E) configurations unless noted otherwise.
About ACLs
This section includes these topics:
• Overview, page 47-2
• Supported Features That Use ACLs, page 47-3
• Router ACLs, page 47-3
• Port ACLs, page 47-4
• Dynamic ACLs, page 47-5
• VLAN Maps, page 47-5
Overview
An ACL is a collection of sequential permit and deny conditions that applies to packets. When a packet
is received on an interface, the switch compares the fields in the packet against any applied ACLs to
verify that the packet has the permissions required to be forwarded, based on the conditions specified in
the access lists. It tests the packets against the conditions in an access list one-by-one. The first match
determines whether the switch accepts or rejects the packets. Because the switch stops testing conditions
after the first match, the order of conditions in the list is critical. If no conditions match, the switch drops
the packet. If no restrictions exist, the switch forwards the packet; otherwise, the switch drops the packet.
Switches traditionally operate at Layer 2, switching traffic within a VLAN. Routers route traffic between
VLANs at Layer 3. The Catalyst 4500 series switch can accelerate packet routing between VLANs by
using Layer 3 switching. The Layer 3 switch bridges the packet, and then routes the packet internally
without going to an external router. The packet is then bridged again and sent to its destination. During
this process, the switch can control all packets, including packets bridged within a VLAN.
You configure access lists on a router or switch to filter traffic and provide basic security for your
network. If you do not configure ACLs, all packets passing using the switch could be allowed on all parts
of the network. You can use ACLs to control which hosts can access different parts of a network or to
decide which types of traffic are forwarded or blocked at router interfaces. For example, you can allow
e-mail traffic to be forwarded but not Telnet traffic. ACLs can be configured to block inbound traffic,
outbound traffic, or both. However, on Layer 2 interfaces, you can apply ACLs only in the inbound
direction.
An ACL contains an ordered list of access control entries (ACEs). Each ACE specifies permit or deny
and a set of conditions the packet must satisfy in order to match the ACE. The meaning of permit or deny
depends on the context in which the ACL is used.