Cisco IE 4000, Software Configuration Manual

Page: 550 / 1066

546
Configuring Network Security with ACLs
Information About Network Security with ACLs
If IEEE 802.1Q tunneling is configured on an interface, any IEEE 802.1Q encapsulated IP packets received on the tunnel
port can be filtered by MAC ACLs, but not by IP ACLs. This is because the switch does not recognize the protocol inside
the IEEE 802.1Q header. This restriction applies to router ACLs and port ACLs.
Port ACLs
\ Port ACLs are ACLs that are applied to Layer 2 interfaces on a switch. Port ACLs are supported only on physical
interfaces and not on EtherChannel interfaces and can be applied only on interfaces in the inbound direction. These
access lists are supported:

Standard IP access lists using source addresses

Extended IP access lists using source and destination addresses and optional protocol type information

MAC extended access lists using source and destination MAC addresses and optional protocol type information
The switch examines ACLs associated with all inbound features configured on a given interface and permits or denies
packet forwarding based on how the packet matches the entries in the ACL. In this way, ACLs control access to a network
or to part of a network.
Figure 74 on page 546 is an example of using port ACLs to control access to a network when all
workstations are in the same VLAN. ACLs applied at the Layer 2 input would allow Host A to access the Human Resources
network, but prevent Host B from accessing the same network. Port ACLs can only be applied to Layer 2 interfaces in
the inbound direction.
Figure 74 Using ACLs to Control Traffic to a Network
When you apply a port ACL to a trunk port, the ACL filters traffic on all VLANs present on the trunk port. When you apply
a port ACL to a port with voice VLAN, the ACL filters traffic on both data and voice VLANs.
With port ACLs, you can filter IP traffic by using IP access lists and non-IP traffic by using MAC addresses. You can filter
both IP and non-IP traffic on the same Layer 2 interface by applying both an IP access list and a MAC access list to the
interface.
Note: You cannot apply more than one IP access list and one MAC access list to a Layer 2 interface. If an IP access list
or MAC access list is already configured on a Layer 2 interface and you apply a new IP access list or MAC access list to
the interface, the new ACL replaces the previously configured one.
Host A
Host B
101365
Research &
Development
network
= ACL denying traffic from Host B
and permitting traffic from Host A
= Packet
Human
Resources
network