Chapter 23 Configuring Network Security
Configuring VLAN ACLs
Command | Purpose |
|
|
Router(config)# | Blocks all traffic to or from the configured MAC address in |
vlan vlan_ID drop | the specified VLAN. |
Router(config)# no | Clears MAC |
mac_address vlan vlan_ID |
|
|
|
This example shows how to block all traffic to or from MAC address 0050.3e8d.6400 in VLAN 12:
Router# configure terminal
Router(config)#
Configuring VLAN ACLs
Note Releases 12.1(11b)E or later supports VLAN ACLs (VACLs).
The following sections describe VACLs:
•Understanding VACLs, page
•Configuring VACLs, page
•Configuring VACL Logging, page
Understanding VACLs
These sections describe VACLs:
•VACL Overview, page
•Bridged Packets, page
•Routed Packets, page
•Multicast Packets, page
VACL Overview
VACLs can provide access control for all packets that are bridged within a VLAN or that are routed into or out of a VLAN or, with releases 12.1(13)E or later, a WAN interface for VACL capture. Unlike regular Cisco IOS standard or extended ACLs that are configured on router interfaces only and are applied on routed packets only, VACLs apply to all packets and can be applied to any VLAN or WAN interface. VACLS are processed in hardware. VACLs use Cisco IOS ACLs. VACLs ignore any Cisco IOS ACL fields that are not supported in hardware.
You can configure VACLs for IP, IPX, and
When you configure a VACL and apply it to a VLAN, all packets entering the VLAN are checked against this VACL. If you apply a VACL to the VLAN and an ACL to a routed interface in the VLAN, a packet coming in to the VLAN is first checked against the VACL and, if permitted, is then checked against the input ACL before it is handled by the routed interface. When the packet is routed to another VLAN, it
Cisco 7600 Series Router Cisco IOS Software Configuration
|
| |
|
