Cisco Systems 4500 Using PACL with VLAN Maps and Router ACLs

47-41
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs Using PACL with VLAN Maps and Router ACLs
This example shows that MAC access group simple-mac-acl is configured on the inbound direction of
interface fa6/1:
Switch# show mac access-group interface fast 6/1
Interface FastEthernet6/1:
Inbound access-list is simple-mac-acl
Outbound access-list is not set
This example shows that access group merge is configured on interface fa6/1:
Switch# show access-group mode interface fast 6/1
Interface FastEthernet6/1:
Access group mode is: merge
Using PACL with VLAN Maps and Router ACLs
On Supervisor Engine II+, for output PACLs, there is no interaction with VACL or output Router ACLs.
See the restrictions listed in the “PACL Configuration Guidelines” section on page 47-36. For PACLs,
the interaction with Router ACLs and VACLs depends on the interface access group mode as shown in
Table 47-1.
Each ACL type listed in Table 47-1 corresponds with these scenarios:
Scenario 1: Host A is connected to an interface in VLAN 20, which has an SVI configured. The interface
has input PACL configured, and the SVI has input Router ACL configured as shown in Figure 47-7:
Table 47-1 Interaction between PACLs, VACLs, and Router ACLs
ACL Type(s) PACL
prefer port
mode prefer VLAN mode merge mode
1. Input Router ACL PACL applied Ingress: Input
Router ACL
applied
Egress:
Output
Router ACL
applied
Ingress: Input PACL, Input Router ACL
(merged) applied in order
Egress: Output Router ACL, output
PACL applied in order
2. VACL PAC L ap pl ie d VAC L
applied Ingress: Input PACL, VACL (merged) applied in order
Egress: VACL, PACL applied in order
3. VACL + Input Router
ACL PACL applied Ingress: VACL +
Input Router
ACL appli ed
Egress:
VACL +
Output
Router ACL
applied
Ingress: PACL, VACL, Input Router
ACL (merged) applied in order
Egress: Output Router ACL, VACL,
PACL applied in order