Content

| 9.6 |  | Securing User Access |
| 9.6.3 |  | Using access lists |

Packet filtering can help limit network traffic and restrict network use by certain users or devices. ACLs can filter traffic as it passes through a switch and permit or deny packets at specified interfaces. This module has also shown how ACLs can be deployed to control management sessions for remote control of the switch.

Recall that an ACL is a sequential collection of permit and deny conditions that apply to packets. When a packet is received on an interface, the switch compares the fields in the packet against any applied ACLs to verify that the packet has the required permissions to be forwarded, based on the criteria specified in the access lists. It tests packets against the conditions in an access list one by one. The first match determines whether the switch accepts or rejects the packets. Because the switch stops testing conditions after the first match, the order of conditions in the list is critical. If no conditions match, the switch rejects the packets. If there are no restrictions, the switch forwards the packet; otherwise, the switch drops the packet.

Switches traditionally operate at Layer 2 only, switching traffic within a VLAN, whereas routers route traffic between VLANs. The Catalyst 3550 switch can accelerate packet routing between VLANs by using Layer 3 switching. The switch bridges the packet, the packet is then routed internally without going to an external router, and then the packet is bridged again to send it to its destination. During this process, the switch can use access lists to filter all data it switches, including data bridged within a VLAN.

Access lists can be configured on a router or switch to provide basic security for a network. If ACLs are not configured, all packets passing through the switch could be allowed onto all parts of the network. ACLs can be used to control which hosts can access different parts of a network, or decide which types of traffic are forwarded or blocked at router interfaces. For example, an ACL might be configured to allow e-mail traffic but not Telnet traffic. Layer 3 access lists can be configured to filter inbound traffic, outbound traffic, or both. Access lists on layer 2 interfaces can only filter inbound traffic.

An ACL contains an ordered list of access control entries (ACEs). Each ACE specifies a set of conditions the data must match, and a permit or deny action to perform when a match is found. The meaning of the permit or deny action depends on the context in which the ACL is used.

The 3550 switch supports two types of ACLs:

- IP ACLs to filter IP traffic at Layer 3, including TCP, UDP, IGMP, and ICMP.
- Ethernet or MAC ACLs to filter traffic at Layer 2.

The switch supports three applications of ACLs to filter traffic.

- Router ACLs filter routed traffic between VLANs and are applied to Layer 3 interfaces. One router ACL can be applied in each direction on an interface.
- Port ACLs filter traffic entering a Layer 2 interface. The switch does not support port ACLs in the outbound direction. Only one IP access list and one MAC access list to a Layer 2 interface can be applied.
- VLAN ACLs or VLAN maps filter all packets (bridged and routed). VLAN maps are used to filter traffic between devices in the same VLAN, or to provide Layer 3 access control based on IP addresses. Unsupported protocols are filtered through MAC addresses by using Ethernet ACEs. After a VLAN map is applied to a VLAN, all packets (routed or bridged) entering the VLAN are checked against the VLAN map. Packets can either enter the VLAN through a switch port at Layer 2, or through a routed port after being routed at Layer 3.

Both router ACLs and VLAN maps can be used on the same switch. However, port ACLs cannot be used on a switch that contains VLAN maps or inbound router ACLs.

When a switch has a Layer 2 interface with an applied IP access list or MAC access list, IP access lists and VLAN maps can be created. However, an IP access list cannot be applied to an input Layer 3 interface on that switch. Also, a VLAN map cannot be applied to any of the switch VLANs. An error message is generated if this is attempted. An IP access list can still be applied to an output Layer 3 interface on a switch with port ACLs.

When a switch has an input Layer 3 ACL or a VLAN map applied to it, an IP access list or MAC access list cannot be applied to a Layer 2 interface on that switch. An error message is generated if this is attempted. However, a port ACL can be applied if the switch has an ACL applied only to an output Layer 3 interface.

If 802.1Q tunneling is configured on an interface, any 802.1Q encapsulated IP packets received on the tunnel port can be filtered by MAC ACLs at Layer 2, but not by IP ACLs at Layer 3. This is because the switch does not recognize the protocol inside the 802.1Q header. This restriction applies to router ACLs, port ACLs, and VLAN maps.