Restrictions For Configuring Ipv4 Access Control Lists - Cisco Catalyst 2960-X Security Configuration Manual
Cisco ios release 15.0(2)ex
Hide thumbs
Also See for Catalyst 2960-X:
- Command reference manual (135 pages) ,
- Hardware installation manual (34 pages) ,
- Getting started manual (25 pages)
Table of Contents
Advertisement
Restrictions for Configuring IPv4 Access Control Lists
Restrictions for Configuring IPv4 Access Control Lists
General Network Security
The following are restrictions for configuring network security with ACLs:
• Not all commands that accept a numbered ACL accept a named ACL. ACLs for packet filters and route
• A standard ACL and an extended ACL cannot have the same name.
• Though visible in the command-line help strings, appletalk is not supported as a matching condition
• ACL wildcard is not supported in downstream client policy.
IPv4 ACL Network Interfaces
The following restrictions apply to IPv4 ACLs to network interfaces:
• When controlling access to an interface, you can use a named or numbered ACL.
• If you apply an ACL to a Layer 2 interface that is a member of a VLAN, the Layer 2 (port) ACL takes
• If you apply an ACL to a Layer 3 interface and routing is not enabled on the switch, the ACL only filters
• You do not have to enable routing to apply ACLs to Layer 2 interfaces.
By default, the router sends Internet Control Message Protocol (ICMP) unreachable messages when a
Note
packet is denied by an access group on a Layer 3 interface. These access-group denied packets are not
dropped in hardware but are bridged to the switch CPU so that it can generate the ICMP-unreachable
message. They do not generate ICMP unreachable messages. ICMP unreachable messages can be disabled
on router ACLs with the no ip unreachables interface command.
MAC ACLs on a Layer 2 Interface
After you create a MAC ACL, you can apply it to a Layer 2 interface to filter non-IP traffic coming in that
interface. When you apply the MAC ACL, consider these guidelines:
• You can apply no more than one IP access list and one MAC access list to the same Layer 2 interface.
• A Layer 2 interface can have only one MAC access list. If you apply a MAC access list to a Layer 2
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
140
filters on interfaces can use a name. VLAN maps also accept a name.
for the deny and permit MAC access-list configuration mode commands.
precedence over an input Layer 3 ACL applied to the VLAN interface or a VLAN map applied to the
VLAN.
packets that are intended for the CPU, such as SNMP, Telnet, or web traffic.
The IP access list filters only IP packets, and the MAC access list filters non-IP packets.
interface that has a MAC ACL configured, the new ACL replaces the previously configured one.
Configuring IPv4 ACLs
OL-29048-01
Hide quick links:
Advertisement
Table of Contents
