Content

| 2.2 |  | VLAN Security |
| 2.2.5 |  | Configuring VLAN maps |

This section briefly describes how to configure VLAN maps, which is the only way to control filtering within a VLAN. VLAN maps have no direction. To filter traffic in a specific direction using a VLAN map, an access list must be configured with a specific source or destination address. Unlike router ACLs, the default action for VLAN maps is to forward, and this action is taken if the packet does not match any of the entries within the map.

To create a VLAN map and apply it to one or more VLANs, perform these steps:

1. Create the standard or extended IP ACLs or named MAC extended ACLs that are going to be applied to the VLAN.
2. Enter the vlan access-map global configuration command to create a VLAN ACL map entry.
3. In access map configuration mode, optionally enter an action, either drop or forward, and enter the match command to match the packet against one or more access lists.
4. Use the vlan filter global configuration command to apply a VLAN map to one or more VLANs.

Remember that VLAN maps have an implicit forward feature at the end of the list; a packet is forwarded if it does not match any ACL within the VLAN map.

Follow these guidelines when configuring VLAN maps:

- If there is no router ACL configured to deny traffic on a routed VLAN interface, and there is no VLAN map configured, all traffic is permitted.
- As with access lists, the order of entries in a VLAN map is important.
- The system might take longer to boot if a large number of ACLs have been configured.

Each VLAN map consists of an ordered series of entries. A packet that comes into the switch is tested against the first entry in the VLAN map. If it matches, the action specified for that part of the VLAN map is taken. If there is no action specified, the default action is to forward. If there is no match, the packet is tested against the next entry in the map. If no entries match, the implicit forward default applies. Beginning in privileged EXEC mode, follow these steps in Figure to create, add to, or delete a VLAN map entry.

Use the no vlan access-map name command to delete a map.

Use the no vlan access-map name number command to delete a single sequence entry from within the map.

Use the no action command to enforce the default action, which is to forward.

VLAN maps do not use the specific permit or deny keywords. To deny a packet by using VLAN maps, create an ACL that would match the packet, and set the action to drop. A permit in the ACL counts as a match. A deny in the ACL means no match.

This example shows how to create an ACL and a VLAN map to deny a packet. In this example, any packets that match the ip1 ACL (TCP packets) would be dropped. First create the IP ACL to permit any TCP packet and no other packets; then set the action for packets that match the permit list to be dropped.

> Switch(config)#ip access-list extended ip1
> Switch(config-ext-nacl)#permit tcp any any
> Switch(config-ext-nacl)#exit
> Switch(config)#vlan access-map map_1 10
> Switch(config-access-map)#match ip address ip1
> Switch(config-access-map)#action drop

The example below shows how to create a VLAN map to permit a packet. In this example, ip2 permits UDP packets and any packets that match the ip2 ACL are forwarded.

> Switch(config)#ip access-list extended ip2
> Switch(config-ext-nacl)#permit udp any any
> Switch(config-ext-nacl)#exit
> Switch(config)#vlan access-map map_1 20
> Switch(config-access-map)#match ip address ip2
> Switch(config-access-map)#action forward

In this example below, any packets that did not match any of the previous ACLs (that is, packets that are not TCP packets or UDP packets) would get dropped.

> Switch(config)#vlan access-map map_1 30
> Switch(config-access-map)#action drop

Beginning in privileged EXEC mode, follow these steps in Figure to apply a VLAN map to one or more VLANs.

This example shows how to apply VLAN map 1 to VLANs 20 through 22:

> Switch(config)#vlan filter map 1 vlan-list 20-22

To display information about VLAN access maps or VLAN filters, use the appropriate show command from the privileged EXEC mode.

The show vlan access-map command will display information about all VLAN access-maps or a specified access map.

> Switch#show vlan access-map [mapname]

The show vlan filter command will display information about all VLAN filters or about a specified VLAN or VLAN access map.

> Switch#show vlan filter [access-map name | vlan vlan-id]

The following are examples of the show commands for access list and VLAN maps.

> Switch#show access-list
> Extended MAC access list mac1
> deny any any decnet-iv
> permit any any
> Switch#show vlan access-map
> Vlan access-map "map_1" 10
> Match clauses:
> ip address: ip1
> Action:
> drop
> Vlan access-map "map_1" 20
> Match clauses:
> mac address: mac1
> Action:
> forward
> Vlan access-map "map_1" 30
> Match clauses:
> Action:
> drop
> Switch#show vlan filter
> VLAN Map map_1 is filtering VLANs:
> 20-22