33-12
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter33 Configuring Network Security with ACLs
Configuring VLAN Maps
You can use the no mac access-list extended name global configuration command to delete the entire
ACL. You can also delete individual ACEs from named MAC extended ACLs.
This example shows how to create and display an access list named ma c1, denying only EtherType
DECnet Phase IV traffic, but permitting all other types of traffic.
Switch(config)# mac access-list extended mac1
Switch(config-ext-macl)# deny any any
decnet-iv
(old) protocol-family decnet (new)
Switch(config-ext-macl)# permit any any
Switch(config-ext-macl)# end
Switch # show access-lists
Extended MAC access list mac1
deny any any
decnet-iv
(old) protocol-family decnet (new)
permit any any
Configuring VLAN Maps
This section contains the following subsections:
•VLAN Map Configuration Guidelines, page 33-13
•Creating and Deleting VLAN Maps, page 33-13
•Applying a VLAN Map to a VLAN, page 33-16
•Using VLAN Maps in Your Network, page 33-16
This section describes how to configure VLAN maps, which is the only way to control filtering within
a VLAN. VLAN maps have no direction. To filter traffic in a specific direction by using a VLAN map,
you need to include an ACL with specific source or destination addresses. If ther e is a match clause for
that type of packet (IP or MAC) in the VLAN map, the default action is to drop the packet if the packet
does not match any of the entries within the map. If there is no match clause for that type of packet, the
default is to forward the packet.
To create a VLAN map and apply it to one or more VLANs, perform this task
Step1 Create the standard or extended IP ACLs or named MAC extended ACLs that you want to apply to the
VLAN.
Step2 Enter the vlan access-map global configuration command to create a VLAN ACL map entry.
Step3 In access map configuration mode, you have the optional to enter an action (for ward [the default] or
drop) and enter the match command to specify an IP packet or a non-IP packet and to match the packet
against one or more ACLs (standard or extended). If a match clause is not specified, the ac tion is applied
to all packets. The match clause can be used to match against multiple ACLs. If a packet matches any of
the specified ACLs, the action is applied.
Note If the VLAN map has a match clause for the type of packet (IP or MAC) and the packet does not
match the type, the default is to drop the packet. If there is no match clause in the VLAN map
for that type of packet, and no action specified, the packet is forwarded.
Step4 Use the vlan filter global configuration command to apply a VLAN map to one or more VLANs.