Cisco Catalyst 3560-X Series, Software Configuration Manual

Page: 911 / 1538

1-43
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-25303-03
Chapter 1 Configuring Network Security with ACLs
Using VLAN Maps with Router ACLs
ACLs and Routed Packets
Figure 1-8 shows how ACLs are applied on routed packets. The ACLs are applied in this order:
1.
VLAN map for input VLAN
2. Input router ACL
3.
Output router ACL
4.
VLAN map for output VLAN
Figure 1-8 Applying ACLs on Routed Packets
ACLs and Multicast Packets
Figure 1-9 shows how ACLs are applied on packets that are replicated for IP multicasting. A multicast
packet being routed has two different kinds of filters applied: one for destinations that are other ports in
the input VLAN and another for each of the destinations that are in other VLANs to which the packet
has been routed. The packet might be routed to more than one output VLAN, in which case a different
router output ACL and VLAN map would apply for each destination VLAN.
The final result is that the packet might be permitted in some of the output VLANs and not in others. A
copy of the packet is forwarded to those destinations where it is permitted. However, if the input VLAN
map (VLAN 10 map in
Figure 1-9 ) drops the packet, no destination receives a copy of the packet.
Frame
Routing function
VLAN 10
Host A
(VLAN 10)
Packet
101359
VLAN 20
Host B
(VLAN 20)
VLAN 10
map
Input
router
ACL
Output
router
ACL
VLAN 20
map