37-2
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 37 Configuring Network Security with ACLs
Information About Network Security with ACLs
switch rejects the packet. If there are no restrictions, the switch forwards the packet; otherwise, the
switch drops the packet. The switch can use ACLs on all packets it forwards, including packets bridged
within a VLAN.
You configure access lists on a router or Layer 3 switch to provide basic security for your network. If
you do not configure ACLs, all packets passing through the switch could be allowed onto all parts of the
network. You can use ACLs to control which hosts can access different parts of a network or to decide
which types of traffic are forwarded or blocked at router interfaces. For exampl e, you can allow e-mail
traffic to be forwarded but not Telnet traffic. ACLs can be configured to block inbound traffic, outbound
traffic, or both.
An ACL contains an ordered list of access control entries (ACEs). Each ACE specifies permit or deny
and a set of conditions the packet must satisfy in order to match the ACE. The meaning of permit or deny
depends on the context in which the ACL is used.
The switch supports IP ACLs and Ethernet (MAC) ACLs:
• IP ACLs filter IPv4 traffic, including TCP, User Datagram Protocol (UDP), Internet Group
Management Protocol (IGMP), and Internet Control Message Protocol (ICMP).
• Ethernet ACLs filter non-IP traffic.
This switch also supports quality of service (QoS) classification ACLs. For more information, see the
“Classification Based on QoS ACLs” section on page 38-13.
These sections contain this conceptual information:
• Supported ACLs, page 37-2
• Handling Fragmented and Unfragmented Traffic, page 37-3
Supported ACLs
Port ACLs access-control traffic entering a Layer 2 interface. The switch does not support port ACLs in
the outbound direction. You can apply only one IP access list and one MAC access list to a Layer 2
interface. For more information, see the “Port ACLs” section on page 37-2.
If IEEE 802.1Q tunneling is configured on an interface, any IEEE 802.1Q encapsulated IP packet s
received on the tunnel port can be filtered by MAC ACLs, but not by IP ACLs. This is because the switch
does not recognize the protocol inside the IEEE 802.1Q header. This restriction applies to router ACLs
and port ACLs.

Port ACLs

Note To use this feature, the switch must be running the LAN Base image.
Port ACLs are ACLs that are applied to Layer 2 interfaces on a switch. Port ACLs are supported only on
physical interfaces and not on EtherChannel interfaces and can be applied only on interfaces in the
inbound direction. These access lists are supported:
• Standard IP access lists using source addresses
• Extended IP access lists using source and destination addre sses and optional protocol type
information
• MAC extended access lists using source and destination MAC addresses and optional protocol type
information