Content

| 2.2 |  | VLAN Security |
| 2.2.6 |  | Using VLAN maps with router ACLs |

To filter both bridged and routed traffic, VLAN maps can be used by themselves or in conjunction with router ACLs. Router ACLs can be applied on both input and output routed VLAN interfaces, and a VLAN map can be used to filter the bridged traffic.

If a packet flow matches a VLAN map deny clause in the ACL, regardless of the router ACL configuration, the packet will be dropped.

When using router ACLs with VLAN maps, packets that require logging on the router ACLs are not logged if they are denied by a VLAN map.

Remember, VLAN maps have a default action of forward, so a packet is forwarded if it does not match any VLAN map entry.

These guidelines are for configurations where a router ACL and a VLAN map need to be applied on the same VLAN. These guidelines do not apply to configurations where router ACLs and VLAN maps are used on different VLANs.

The switch hardware provides one lookup for security ACLs for each direction, input and output. As a result, a router ACL and a VLAN map must be merged when they are configured on the same VLAN.

Merging the router ACL with the VLAN map might significantly increase the number of ACEs.

If a router ACL and a VLAN map must be configured on the same VLAN, use these guidelines for both router ACL and VLAN map configuration.

- Whenever possible, try to write the ACL with all entries having a single action except for the final, default action of the other type. That is, write the ACL using one of these two forms.

> permit...
> permit...
> permit...
> deny ip any any

> or

> deny...
> deny...
> deny...
> permit ip any any

- To define multiple permit and deny actions in an ACL, group each action type together to reduce the number of entries.
- Avoid including Layer 4 information in an ACL.
- Use wildcard masks in the IP address, whenever possible.

The best merge results are obtained if the ACLs are filtered based on source or destination IP addresses and not on the full flow (source IP address, destination IP address, protocol, and protocol ports). If the full flow must be specified, and the ACL contains both IP ACEs and TCP/UDP/ICMP ACEs with Layer 4 information, put the Layer 4 ACEs at the end of the list. This gives priority to the filtering of traffic based on IP addresses.

ACL processing in the 3550 switch is mostly done in hardware, but if the hardware exceeds its capacity to store ACL configurations, the switch software attempts to fit a simpler configuration into hardware. This simpler configuration does not do all the filtering that has been configured, but instead sends some or all packets to the CPU to be filtered by software. All configured filtering will be accomplished, but performance is greatly decreased when the filtering done in software.

Any problem in fitting the configuration into hardware is logged, but it is possible that not everyone who configures the switch can see the log messages as they occur. The show fm command can be executed from privileged mode to determine if any interface or VLAN configuration did not fit into hardware. It is a two-step process.

> Switch#show fm vlan vlan-id

> or

> Switch#show fm interface interface-id

The show fm command will display feature manager information for the interface or the VLAN. It is also used to determine what label was used in the hardware for the interface or VLAN configuration.

> Switch#show fm label name

The show fm label command will display which of the configured ACL features fit into hardware.