Content

| 2.2 |  | VLAN Security |
| 2.2.2 |  | Understanding switch ACLs |

Packet filtering can help limit network traffic and restrict network use by certain users or devices. ACLs can filter traffic as it passes through a router and permit or deny packets from crossing specified interfaces. An ACL contains an ordered list of access control entries (ACEs). Each ACE specifies permit or deny and a set of conditions the packet must satisfy in order to match the ACE. The meaning of permit or deny depends on the context in which the ACL is used.

ACLs on switches function very much like those on a router. When a frame is received on an interface, the switch compares the fields in the frame against any applied access lists to verify that it should be forwarded, based on the criteria specified in the access lists. It tests frames against the conditions in an access list one by one.

The first match determines whether the switch accepts or rejects the packets. Because the switch stops testing conditions after the first match, the order of conditions in the list is critical. If no conditions match, the switch rejects the packets.

If a switch is not configured with access lists, all packets passing it will be allowed onto all parts of the network. Access lists can be used to control which hosts can access different parts of a network or to decide which types of traffic are forwarded or blocked at router interfaces. For example, a Layer 3 switch can be configured to allow e-mail traffic to be forwarded, but not Telnet traffic. ACLs can be configured to block inbound traffic, outbound traffic, or both.

The Catalyst 3550 switch supports two types of ACLs:

- IP ACLs filter IP traffic, including TCP, User Datagram Protocol (UDP), Internet Group Management Protocol (IGMP), and Internet Control Message Protocol (ICMP).
- Ethernet ACLs filter non-IP traffic.
- The 2950 switch supports only IP ACLs.

The 3550 switch supports two applications of ACLs to filter traffic:

- Router ACLs
- VLAN ACLs

Router ACLs filter routed traffic between VLANs. In order for a Catalyst 3550 to filter packets routed between VLANs, it must be running the EMI.

VLAN ACLs, also called VLAN maps, filter both bridged and routed packets. VLAN maps can be used to filter packets exchanged between devices in the same VLAN. Unlike router ACLs, a switch does not need to run EMI software in order to use VLAN maps. VLAN ACLs are configured to provide access control based on Layer 3 IP addresses. Frames for non-IP protocols can be filtered based on their MAC addresses, using Ethernet ACEs.

When a VLAN map is applied to a VLAN, all packets (routed or bridged) entering the VLAN are checked against the VLAN map. Packets can either enter the VLAN through a switch port or through a routed port after being routed.

The 3550 switch also supports Quality of Service (QoS) classification ACLs.