19-28
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-03
Chapter 19 Configuring Network Security with ACLs
Configuring VLAN Maps
Step 4
Use the vlan filter global configuration command to apply a VLAN map to one or more VLANs.
This section contains these topics:
•
VLAN Map Configuration Guidelines, page 19-28
•
Creating Named MAC Extended ACLs, page 19-28
•
Creating a VLAN Map, page 19-30
•
Applying a VLAN Map to a VLAN, page 19-32
•
Displaying VLAN Map Information, page 19-33
VLAN Map Configuration Guidelines
Follow these guidelines when configuring VLAN maps:
•
If there is no router ACL configured to deny traffic on a routed VLAN interface (input or output),
and no VLAN map configured, all traffic is permitted.
•
Each VLAN map consists of a series of entries. The order of entries in an VLAN map is important.
A packet that comes into the switch is tested against the first entry in the VLAN map. If it matches,
the action specified for that part of the VLAN map is taken. If there is no match, the packet is tested
against the next entry in the map.
•
If the VLAN map has at least one match clause for the type of packet (IP or MAC) and the packet
does not match any of these match clauses, the default is to drop the packet. If there is no match
clause for that type of packet in the VLAN map, the default is to forward the packet.
•
The system might take longer to boot if you have configured a very large number of ACLs.
•
For information about using both router ACLs and VLAN maps, see the
“Guidelines” section on
page 19-36
.
•
See the
“Using VLAN Maps in Your Network” section on page 19-33
for configuration examples.
Creating Named MAC Extended ACLs
You can filter non-IP traffic on a VLAN by using MAC addresses and named MAC extended ACLs. The
procedure is similar to that of configuring other extended named ACLs.
Note
Named MAC extended ACLs can only be applied to VLAN maps.
For more information about the supported non-IP protocols in the mac access-list extended command,
refer to the Catalyst 3550 Multilayer Switch Command Reference for this release.
Note
Though visible in the command-line help strings, appletalk is not supported as a matching condition
for the deny and permit MAC access-list configuration mode commands, nor is matching on any
SNAP-encapsulated packet with a non-zero Organizational Unique Identifier (OUI).
