Cisco Systems 4500 Displaying VLAN Access Map Information, Using VLAN Maps with Router ACLs

47-32
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs
Displaying VLAN Access Map Information
Displaying VLAN Access Map Information
To display information about VLAN access maps or VLAN filters, perform one of these commands:
it is a sample output of the show vlan access-map command:
Switch# show vlan access-map
Vlan access-map "map_1" 10
Match clauses:
ip address: ip1
Action:
drop
Vlan access-map "map_1" 20
Match clauses:
mac address: mac1
Action:
forward
Vlan access-map "map_1" 30
Match clauses:
Action:
drop
Note Sequence 30 does not have a match clause. All packets (IP as well as non-IP) are matched against it and
dropped.
it is a sample output of the show vlan filter command:
Switch# show vlan filter
VLAN Map map_1 is filtering VLANs:
20-22
Using VLAN Maps with Router ACLs
If the VLAN map has a match clause for a packet type (IP or MAC) and the packet does not match the
type, the default is to drop the packet. If there is no match clause in the VLAN map, and no action is
specified, the packet is forwarded if it does not match any VLAN map entry.
Note You cannot combine VLAN maps or input router ACLs with port ACLs on a switch.
Guidelines for Using Router ACLs and VLAN Maps on the Same VLAN
Because the switch hardware performs one lookup for each direction (input and output), you must merge
a router ACL and a VLAN map when they are configured on the same VLAN. Merging the router ACL
with the VLAN map can significantly increase the number of ACEs.
Command Purpose
Switch# show vlan access-map [mapname]Shows information about all VLAN access maps or the
specified access map.
Switch# show vlan filter [access-map name |
vlan vlan-id]Shows information about all VLAN filters or about a
specified VLAN or VLAN access map.