Content

| 2.2 |  | VLAN Security |
| 2.2.3 |  | Router ACLs |

Router ACLs are applied to Switched Virtual Interfaces (SVIs), which are Layer 3 VLAN interfaces. Router ACLs are also applied to physical Layer 3 interfaces and to Layer 3 EtherChannel interfaces. Router ACLs are applied on interfaces as either inbound or outbound.

One ACL can be used with multiple features for a given interface, and one feature can use multiple ACLs. When a single router ACL is used by multiple features, it is examined multiple times.

- Standard IP access lists use source addresses for matching operations.
- Extended IP access lists use source and destination addresses and optional protocol type information for matching operations.

The switch examines ACLs associated with features configured on a given interface and a direction. As packets enter the switch on an interface, ACLs associated with all inbound features configured on that interface are examined. After packets are routed and before they are forwarded out to the next hop, all ACLs associated with outbound features configured on the egress interface are examined.

ACLs permit or deny packet forwarding based on how the packet matches the entries in the ACL. For example, access lists can be used to allow one host to access a part of a network, but prevent another host from accessing the same part. Access lists applied at the router input allow Host A to access the Human Resources network, but prevent Host B from accessing the same network.

VLAN maps can filter all traffic received by the switch. VLAN maps are applied to all packets that are routed into or out of a VLAN or are bridged within a VLAN. VLAN maps are used strictly for security packet filtering. Unlike router ACLs, VLAN maps are not defined by direction (input or output).

VLAN maps can be configured to match Layer 3 addresses for IP traffic. All non-IP protocols are filtered through MAC addresses and Ethertype using MAC VLAN maps. IP traffic is not access controlled by MAC VLAN maps. VLAN maps can only be enforced on packets going through the switch. They cannot be enforced on traffic between hosts on a hub or on another switch connected to the switch on which the VLAN map is applied.

With VLAN maps, packets are forwarded or dropped, based on the action specified in the map. A VLAN map is applied to deny a specific type of traffic from Host A in VLAN 10 from being forwarded.