vacl & snmp

8/3/2019 VACL & snmp

1/3

VLAN Access Lists

Access lists can manage or control traffic as it passes through a switch. When normal access lists are

configured on a Catalyst switch, they filter traffic through the use of the Ternary content-addressable

memory (TCAM). Recall from Chapter 2, Switch Operation, that access lists (also known as router

access lists, or RACLs) are merged or compiled into the TCAM. Each ACL is applied to an interfaceaccording to the direction of trafficinbound or outbound. Packets then can be filtered in hardware

with no switching performance penalty. However, only packets that pass between VLANs can be

filtered this way.

Packets that stay in the same VLAN do not cross a VLAN or interface boundary and do not necessarily

have a direction in relation to an interface. These packets also might be non-IP, non-IPX, or

completely bridged; therefore, they never pass through the multilayer switching mechanism. VLAN

access lists (VACL) are filters that directly can affect how packets are handled within a VLAN.

VACLs are somewhat different from RACLs or traditional access control lists. Although they, too, are

merged into the TCAM, they can permit, deny, or redirect packets as the are matched. VACLs also are

configured in a route map fashion, with a series of matching conditions and actions to take.

VACL Configuration

VACLs are configured as a VLAN access map in much the same format as a route map. A VLAN access

map consists of one or more statements, each having a common map name. First, you define the

VACL with the following global configuration command:

Switch(config)# vlan access-map map-name [sequence-number]

Access map statements are evaluated in sequence according to the sequence-number. Each

statement can contain one or more matching conditions, followed by an action. Next, define thematching conditions that identify the traffic to be filtered. Matching is performed by access lists (IP,

IPX, or MAC address ACLs), which you must configure independently.

Configure a matching condition with one of the following access map configuration commands:

Switch(config-access-map)# match ip address {acl-number|acl-name}

Switch(config-access-map)# match ipx address {acl-number|acl-name}

Switch(config-access-map)# match mac address acl-name

You can repeat these commands to define several matching conditions; the first match encountered

triggers an action to take. Define the action with the following access map configuration command:

A VACL can either drop a matching packet, forward it, or redirect it to another interface. The TCAM

performs the entire VACL match and action as packets are switched or bridged within a VLAN or

routed into or out of a VLAN.

Finally, you must apply the VACL to a VLAN using the following global configuration command:

Switch(config)# vlan filter map-name vlan-list vlan-list


2/3

Notice that the VACL is applied globally to one or more VLANs listed and not to a VLAN interface

(SVI). Recall that VLANs can be present in a switch as explicit interfaces or as inherent Layer 2

entities. The VLAN interface is the point where packets enter or leave a VLAN, so it does not make

sense to apply a VACL there. Instead, the VACL needs to function within the VLAN itself, where there

is no inbound or outbound direction.

For example, suppose that you need to filter traffic within VLAN 99 so that host192.168.99.17 is not

allowed to contact any other host on its local subnet. Access list local-17 is created to identify traffic

between this host and anything else on its local subnet.

Then a VLAN access map is defined: If the local-17 access list permits the IP address, the packet is

dropped; otherwise, the packet is forwarded. Example 17-1 shows the commands necessary for this

example.

Example 17-1 Filtering Traffic Within the Local Subnet

Switch(config)# ip access-list extended local-17

Switch(config-acl)# permit ip host 192.168.99.17 192.168.99.0 0.0.0.255

Switch(config-acl)# exit

Switch(config)# vlan access-map block-17 10

Switch(config-access-map)# match ip address local-17

Switch(config-access-map)# action drop

Switch(config-access-map)# vlan access-map block-17 20

Switch(config-access-map)# action forward

Switch(config-access-map)# exit

Switch(config)# vlan filter block-17 vlan-list 99

Configuration SNMP (Cisco Switchs & Routers )


3/3

NOTE:A community string is like a password. In the case of the first command,

the community string grants you access to SNMP.

vacl & snmp

Documents