Content

| 2.2 |  | VLAN Security |
| 2.2.7 |  | Applying router ACLs and VLAN maps on VLANs |

This section contains examples of applying router ACLs and VLAN maps to a VLAN for switched, bridged, routed, and multicast packets. Although the following illustrations show packets being forwarded to their destination, each time the packet’s path crosses a line indicating a VLAN map or an ACL, it is also possible that the packet might be dropped, rather than forwarded.

Packets switched within the VLAN without being routed are only subject to the VLAN map of the input VLAN.

For routed packets, the ACLs are applied in this order:

- VLAN map for input VLAN
- Input router ACL
- Output router ACL
- VLAN map for output VLAN

A multicast packet that is being routed has two different kinds of filters applied: one for destinations that are other ports in the input VLAN and another for each of the destinations that are in other VLANs to which the packet has been routed. The packet might be routed to more than one output VLAN, in which case a different router output ACL and VLAN map would apply for each destination VLAN.

The final result is that the packet might be permitted in some of the output VLANs and not in others. A copy of the packet is forwarded to those destinations where it is permitted. However, if the input VLAN map drops the packet, no destination receives a copy of the packet.