Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения

Страница: 1645 / 2086

62-21
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 62 Configuring Network Security with ACLs
Configuring VLAN Maps
Note Output IPv6 ACLs with ACE to match on the ICMP option fail on a switch.
The following conditions may cause a RACL to malfunction (no workaround):
•
ACLs are applied on the output direction of the interface.
• IPv6 ACL contain Ace to match on the ICMP option fields (ICMP Type or ICMP Code).
The following examples of nonfunctioning RACLs:
IPv6 access list a1
permit icmp any any nd-ns sequence 10
deny ipv6 any any sequence 20
IPv6 access list a2
permit icmp 2020::/96 any nd-ns sequence 10
deny ipv6 any any sequence 20
Configuring VLAN Maps
This section includes these topics:
•
VLAN Map Configuration Guidelines, page 62-22
•
Creating and Deleting VLAN Maps, page 62-22
•
Applying a VLAN Map to a VLAN, page 62-25
• Using VLAN Maps in Your Network, page 62-25
This section describes how to configure VLAN maps, which is the only way to control filtering within
a VLAN. VLAN maps have no direction. To filter traffic in a specific direction by using a VLAN map,
you need to include an ACL with specific source or destination addresses. If there is a match clause for
that type of packet (IP or MAC) in the VLAN map, the default action is to drop the packet if the packet
does not match any of the entries within the map. If there is no match clause for that type of packet, the
default is to forward the packet.
To create a VLAN map and apply it to one or more VLANs, follow these steps:
Step 1 Create the standard or extended IP ACLs or named MAC extended ACLs that you want to apply to the
VLAN.
Step 2
Enter the vlan access-map global configuration command to create a VLAN ACL map entry.
In access map configuration mode, you have the option to enter an action ( forward [the default] or
drop ) and enter the match command to specify an IP packet or a non-IP packet and to match the packet
against one or more ACLs (standard or extended). If a match clause is not specified, the action is applied
to all packets. The match clause can be used to match against multiple ACLs. If a packet matches any of
the specified ACLs, the action is applied.
Note
If the VLAN map has a match clause for the type of packet (IP or MAC) and the packet does not
match the type, the default is to drop the packet. If there is no match clause in the VLAN map
for that type of packet, and no action specified, the packet is forwarded.