Using Vlan Maps With Router Acls - Cisco 3845 - Security Bundle Router Software Manual
Software configuration guide
Hide thumbs
Also See for 3845 - Security Bundle Router:
- Manual (94 pages) ,
- Quick start manual (38 pages) ,
- Hardware installation manual (418 pages)
Table of Contents
Advertisement
Chapter 26
Configuring Network Security with ACLs
Figure 26-5
10.1.1.100
10.1.1.4
10.1.1.8
This example shows how to deny access to a server on another VLAN by creating the VLAN map
SERVER 1 that denies access to hosts in subnet 10.1.2.0.8, host 10.1.1.4, and host 10.1.1.8 and permits
other IP traffic. The final step is to apply the map SERVER1 to VLAN 10.
Define the IP ACL that will match the correct packets.
Step 1
Switch(config)# ip access-list extended SERVER1_ACL
Switch(config-ext-nacl))# permit ip 10.1.2.0 0.0.0.255 host 10.1.1.100
Switch(config-ext-nacl))# permit ip host 10.1.1.4 host 10.1.1.100
Switch(config-ext-nacl))# permit ip host 10.1.1.8 host 10.1.1.100
Switch(config-ext-nacl))# exit
Define a VLAN map using this ACL that will drop IP packets that match SERVER1_ACL and forward
Step 2
IP packets that do not match the ACL.
Switch(config)# vlan access-map SERVER1_MAP
Switch(config-access-map)# match ip address SERVER1_ACL
Switch(config-access-map)# action drop
Switch(config)# vlan access-map SERVER1_MAP 20
Switch(config-access-map)# action forward
Switch(config-access-map)# exit
Apply the VLAN map to VLAN 10.
Step 3
Switch(config)# vlan filter SERVER1_MAP vlan-list 10.
Using VLAN Maps with Router ACLs
To access control routed traffic, you can use VLAN maps only or a combination of router ACLs and
VLAN maps. You can define router ACLs on both input and output routed VLAN interfaces. If a packet
flow matches a VLAN-map deny clause in the ACL, regardless of the router ACL configuration, the
packet flow is denied.
When you use router ACLs with VLAN maps, packets that require logging on the router ACLs are not
Note
logged if they are denied by a VLAN map.
OL-23400-01
Deny Access to a Server on Another VLAN
VLAN map
Server (VLAN 10)
Host (VLAN 10)
Host (VLAN 10)
Layer 3 switch
Cisco ME 3800X and 3600X Switch Software Configuration Guide
Using VLAN Maps with Router ACLs
Subnet
10.1.2.0/8
Host (VLAN 20)
Packet
26-35
- Quick Links:
- Performance Features
Hide quick links:
Advertisement
Chapters
Table of Contents
Troubleshooting
