Content

| 9.6 |  | Securing User Access |
| 9.6.5 |  | Port ACLs |

ACLs can also be applied to Layer 2 interfaces on a switch. Port ACLs are supported on physical interfaces only and not on EtherChannel interfaces. Port ACLs are applied on interfaces for inbound traffic only.

These access lists are supported on Layer 2 interfaces:

- Standard IP access lists using source addresses.
- Extended IP access lists using source and destination addresses and optional protocol type information.
- MAC extended access lists using source and destination MAC addresses and optional protocol type information.

As with router ACLs, the switch examines ACLs associated with features configured on a given interface and permits or denies packet forwarding based on how the packet matches the entries in the ACL.

However, ACLs can only be applied to Layer 2 interfaces in the inbound direction. If all workstations were in the same VLAN, ACLs applied at the Layer 2 input would allow Host A to access the Human Resources network, but prevent Host B from accessing the same network.

When a port ACL is applied to a trunk port, the ACL filters traffic on all VLANs present on the trunk port. When a port ACL is applied to a port with voice VLAN, the ACL filters traffic on both data and voice VLANs.

With port ACLs, IP traffic can be filtered using IP access lists. Using MAC ACLs permits non-IP traffic to be filtered. Both IP and non-IP traffic can be filtered on the same Layer 2 interface by applying both an IP access list and a MAC access list to the interface.

Only one IP access list and one MAC access list can be applied to a Layer 2 interface. If an IP access list or MAC access list is already configured on a Layer 2 interface and a new IP access list or MAC access list is applied to the interface, the new ACL replaces the previously configured one.