Cisco Catalyst 3560-X Series, Software Configuration Manual

Page: 875 / 1538

1-7
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-25303-03
Chapter 1 Configuring Network Security with ACLs
Configuring IPv4 ACLs
•
Packet B is from host 10.2.2.2, port 65001, going to host 10.1.1.2 on the Telnet port. If this packet
is fragmented, the first fragment matches the second ACE (a deny) because all Layer 3 and Layer 4
information is present. The remaining fragments in the packet do not match the second ACE because
they are missing Layer 4 information. Instead, they match the third ACE (a permit).
Because the first fragment was denied, host 10.1.1.2 cannot reassemble a complete packet, so packet
B is effectively denied. However, the later fragments that are permitted will consume bandwidth on
the network and resources of host 10.1.1.2 as it tries to reassemble the packet.
•
Fragmented packet C is from host 10.2.2.2, port 65001, going to host 10.1.1.3, port ftp. If this packet
is fragmented, the first fragment matches the fourth ACE (a deny). All other fragments also match
the fourth ACE because that ACE does not check any Layer 4 information and because Layer 3
information in all fragments shows that they are being sent to host 10.1.1.3, and the earlier permit
ACEs were checking different hosts.
ACLs and Switch Stacks
ACL support is the same for a switch stack as for a standalone switch. ACL configuration information
is propagated to all switches in the stack. All switches in the stack, including the stack master, process
the information and program their hardware. (For more information about switch stacks, see
Chapter 1,
“Configuring the Switch Stack.” )
The stack master performs these ACL functions:
• It processes the ACL configuration and propagates the information to all stack members.
•
It distributes the ACL information to any switch that joins the stack.
• If packets must be forwarded by software for any reason (for example, not enough hardware
resources), the master switch forwards the packets only after applying ACLs on the packets.
•
It programs its hardware with the ACL information it processes.
Stack members perform these ACL functions:
•
They receive the ACL information from the master switch and program their hardware.
• They act as standby switches, ready to take over the role of the stack master if the existing master
were to fail and they were to be elected as the new stack master.
When a stack master fails and a new stack master is elected, the newly elected master reparses the backed
up running configuration. (See
Chapter 1, “Configuring the Switch Stack.” ) The ACL configuration that
is part of the running configuration is also reparsed during this step. The new stack master distributes
the ACL information to all switches in the stack.
Configuring IPv4 ACLs
Configuring IP v4ACLs on the switch is the same as configuring IPv4 ACLs on other Cisco switches and
routers. The process is briefly described here. For more detailed information on configuring ACLs, see
the “Configuring IP Services” section in the “IP Addressing and Services” chapter of the
Cisco IOS IP
Configuration Guide, Release 12.4. For detailed information about the commands, see the Cisco IOS IP
Command Reference, Volume 1 of 3: Addressing and Services, Release 12.4.
The switch does not support these Cisco IOS router ACL-related features:
•
Non-IP protocol ACLs (see Table 1-1 on page 1-9 ) or bridge-group ACLs
• IP accounting