Content

| 9.6 |  | Securing User Access |
| 9.6.6 |  | VLAN ACLs and VLAN maps |

VLAN maps, also known as VLAN ACLs or VACLs, can filter all traffic traversing a switch. VLAN maps can be configured on the switch to filter all packets that are routed into or out of a VLAN, or are bridged within a VLAN. VLAN maps are used strictly for security packet filtering. Unlike router ACLs, VLAN maps are not defined by direction (input or output).

VLAN maps can be configured to filter on packet characteristics and Layers 3 and 4. All non-IP protocols are filtered through MAC addresses and Ethertype using MAC VLAN maps (IP traffic is not filtered by MAC VLAN maps). VLAN maps can only be enforced on packets going through the switch; VLAN maps cannot be enforced on traffic between hosts on a hub or on another switch connected to this switch.

With VLAN maps, forwarding of packets is permitted or denied, based on the action specified in the map. VLAN maps use match clauses to select traffic and perform operations on it. Each clause contains one or more access lists, each of which use permit and deny actions to select or ignore traffic. VLAN maps are like access-lists made up of other access-lists. Figure illustrates how a VLAN map is applied to deny a specific type of traffic from Host A in VLAN 10 from being forwarded.

VLAN maps are the only way to control filtering within a VLAN. VLAN maps have no direction. That is, unlike IP access-lists, they do not differentiate between inbound and outbound traffic. To filter traffic in a specific direction by using a VLAN map, you need to include an ACL with specific source or destination addresses. If there is a match clause for a type of packet (IP or MAC) in the VLAN map, and that packet does not match any of the entries within the map, the default VLAN map action is to drop the packet. If there is no match clause for that type of packet, the default is to forward the packet.

To create a VLAN map and apply it to one or more VLANs, perform these steps:

- Create the standard or extended IP ACLs or named MAC extended ACLs to be applied to the VLAN. This access-list will select the traffic that will be either forwarded or dropped by the access-map. Only traffic matching the ‘permit’ condition in an access-list will be passed to the access-map for further processing.
- Enter the

vlan access-map access-map-name [sequence] global configuration command to create a VLAN ACL map entry. Each access-map can have multiple entries. The order of these entries is determined by the sequence. If no sequence number is entered, access-map entries are added with sequence numbers in increments of 10.
- In access map configuration mode, optionally enter an action forward or action drop. The default is to forward traffic. Also enter the
match command to specify an IP packet or a non-IP packet (with only a known MAC address), and to match the packet against one or more ACLs (standard or extended).
- Use the
vlan filter access-map-name vlan-list vlan-list global configuration command to apply a VLAN map to one or more VLANs. A single access-map can be used on multiple VLANs.

Note that a VLAN map cannot be applied to a VLAN on a switch that has ACLs applied to Layer 2 interfaces (port ACLs).