Cisco Catalyst 2960 Series, Configuration Manual

Page: 1256 / 2288

Prerequisites for Configuring IPv4 Access Control Lists
This section lists the prerequisites for configuring network security with access control lists (ACLs).
• On switches running the LAN base feature set, VLAN maps are not supported.
Restrictions for Configuring IPv4 Access Control Lists
General Network Security
The following are restrictions for configuring network security with ACLs:
• Not all commands that accept a numbered ACL accept a named ACL. ACLs for packet filters and route
filters on interfaces can use a name. VLAN maps also accept a name.
• A standard ACL and an extended ACL cannot have the same name.
• Though visible in the command-line help strings,
appletalk
is not supported as a matching condition
for the deny and permit MAC access-list configuration mode commands.
IPv4 ACL Network Interfaces
The following restrictions apply to IPv4 ACLs to network interfaces:
• When controlling access to an interface, you can use a named or numbered ACL.
• If you apply an ACL to a Layer 2 interface that is a member of a VLAN, the Layer 2 (port) ACL takes
precedence over an input Layer 3 ACL applied to the VLAN interface or a VLAN map applied to the
VLAN.
• If you apply an ACL to a Layer 3 interface and routing is not enabled on the switch, the ACL only filters
packets that are intended for the CPU, such as SNMP, Telnet, or web traffic.
• You do not have to enable routing to apply ACLs to Layer 2 interfaces.
By default, the router sends Internet Control Message Protocol (ICMP) unreachable messages when a
packet is denied by an access group on a Layer 3 interface. These access-group denied packets are not
dropped in hardware but are bridged to the switch CPU so that it can generate the ICMP-unreachable
message. They do not generate ICMP unreachable messages. ICMP unreachable messages can be disabled
on router ACLs with the
no ip unreachables
interface command.
Note
MAC ACLs on a Layer 2 Interface
After you create a MAC ACL, you can apply it to a Layer 2 interface to filter non-IP traffic coming in that
interface. When you apply the MAC ACL, consider these guidelines:
• You can apply no more than one IP access list and one MAC access list to the same Layer 2 interface.
The IP access list filters only IP packets, and the MAC access list filters non-IP packets.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1174
Prerequisites for Configuring IPv4 Access Control Lists