30-2
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Chapter 30 Configuring Network Security with ACLs
Understanding ACLs
The switch supports IP ACLs to filter IPv4 traffic, including TCP, User Datagram Protocol (UDP),
Internet Group Management Protocol (IGMP), and Internet Control Message Protocol (ICMP).
These sections contain this conceptual information:
•
•
Handling Fragmented and Unfragmented Traffic, page 30-3
ACL Overview
These access lists are supported:
•
Standard IP access lists using source addresses
•
Extended IP access lists using source and destination addresses and optional protocol type
information
The switch examines ACLs associated with all inbound or outbound features configured on a given
VLAN interface and permits or denies packet forwarding to and from the CPU based on how the packet
matches the entries in the ACL. In this way, ACLs control access to a network or to part of a network.
is an example of using ACLs to control access to a network when all workstations are in the
same VLAN. ACLs applied at the Layer 2 input would allow Host A to access the Human Resources
network, but prevent Host B from accessing the same network.
Port ACLs
Port ACLs access-control traffic entering a Layer 2 interface. The switch does not support port ACLs in
the outbound direction. You can apply only one IP access list and one MAC access list to a Layer 2
interface. Port ACLs can only be applied to Layer 2 interfaces in the inbound direction.
When you apply a port ACL to a trunk port, the ACL filters traffic on all VLANs present on the trunk
port. When you apply a port ACL to a port with voice VLAN, the ACL filters traffic on both data and
voice VLANs.
With port ACLs, you can filter IP traffic by using IP access lists and non-IP traffic by using MAC
addresses. You can filter both IP and non-IP traffic on the same Layer 2 interface by applying both an IP
access list and a MAC access list to the interface.
