Cisco ME 3600X, Справочник по командам

Страница: 121 / 628

2-97
Cisco ME 3800X and ME 3600X Switch Command Reference
OL-28238-01
Chapter 2 Cisco ME 3800X and ME 3600X Switch Cisco IOS Commands
ip access-group
You can use this command to apply an access list to a Layer 2 interface (port ACL) or Layer 3 interface.
However, note these limitations for port ACLs:
• You can only apply ACLs in the inbound direction; the out keyword is not supported for Layer 2
interfaces.
•
You cannot apply an ACL to a port configured with a service instance. Layer 2 ACLs are not
supported on these ports.
– If you try to configure a service instance on a port that has a port ACL attached, the service port
configuration is rejected with a warning message.
–
If you try to attach a port ACL to a port that has a service instance, the configuration is rejected
with a warning message.
• You can only apply one IP ACL and one MAC ACL per interface.
•
Port ACLs do not support logging; if the log keyword is specified in the IP ACL, it is ignored.
• An IP ACL applied to a Layer 2 interface only filters IP packets. To filter non-IP packets, use the
mac access-group interface configuration command with MAC extended ACLs.
You can use router ACLs, input port ACLs, and VLAN maps on the same switch. However, a port ACL
always takes precedence. When both an input port ACL and a VLAN map are applied, incoming packets
received on ports with the port ACL applied are filtered by the port ACL. Other packets are filtered by
the VLAN map.
• When an input port ACL is applied to an interface and a VLAN map is applied to a VLAN that the
interface is a member of, incoming packets received on ports with the ACL applied are filtered by
the port ACL. Other packets are filtered by the VLAN map.
•
When an input router ACL and input port ACLs exist in an switch virtual interface (SVI), incoming
packets received on ports to which a port ACL is applied are filtered by the port ACL. Incoming
routed IP packets received on other ports are filtered by the router ACL. Other packets are not
filtered.
• When an output router ACL and input port ACLs exist in an SVI, incoming packets received on the
ports to which a port ACL is applied are filtered by the port ACL. Outgoing routed IP packets are
filtered by the router ACL. Other packets are not filtered.
•
When a VLAN map, input router ACLs, and input port ACLs exist in an SVI, incoming packets
received on the ports to which a port ACL is applied are only filtered by the port ACL. Incoming
routed IP packets received on other ports are filtered by both the VLAN map and the router ACL.
Other packets are filtered only by the VLAN map.
• When a VLAN map, output router ACLs, and input port ACLs exist in an SVI, incoming packets
received on the ports to which a port ACL is applied are only filtered by the port ACL. Outgoing
routed IP packets are filtered by both the VLAN map and the router ACL. Other packets are filtered
only by the VLAN map.
•
VLAN maps are applied to all switchports that belong to the VLAN, as well as EFPs with a bridge
domain equal to the VLAN.
You can apply IP ACLs to both outbound or inbound Layer 3 interfaces.
A Layer 3 interface can have one IP ACL applied in each direction.
You can configure only one VLAN map and one router ACL in each direction (input/output) on a VLAN
interface.
For standard inbound access lists, after the switch receives a packet, it checks the source address of the
packet against the access list. IP extended access lists can optionally check other fields in the packet,
such as the destination IP address, protocol type, or port numbers. If the access list permits the packet,