•
L2 ACL is supported over port channel with Normal EFPs.
•
Egress L2 ACL on EVC is
not
supported.
•
L2 ACLs are
not
supported on Trunk EFP.
•
L2 ACL counters are
not
supported.
•
Layer2 ACL can be applied on layer 2 frame without IPv4 or IPv6 header as layer 2 ACL does not
support filter on IPv4 or IPv6 traffic.
•
Layer 2 ACLs function inbound only. The Layer 2 ACLs are
not
supported at physical interface level.
EVCs
An Ethernet virtual circuit (EVC) as defined by the Metro Ethernet Forum is a port-level point-to-point or
multipoint-to-multipoint Layer 2 circuit. It is an end-to-end representation of a single instance of a Layer 2
service being offered by a provider to a customer. An EVC contains the different parameters on which the
service is being offered. A service instance is the instantiation of an EVC on a specified port.
Service instances are configured under a port channel. The traffic carried by the service instance is load
balanced across member links. Service instances under a port channel are grouped and each group is associated
with one member link. Ingress traffic for a single EVC can arrive on any member of the bundle. All egress
traffic for a service instance uses only one of the member links. Load balancing is achieved by grouping
service instances and assigning them to a member link.
Ethernet virtual connection services (EVCS) uses the EVCs and service instances to provide Layer 2 switched
Ethernet services. EVC status can be used by a customer edge (CE) device either to find an alternative path
to the service provider network or in some cases, to fall back to a backup path over Ethernet or over another
alternative service such as ATM.
For information about the Metro Ethernet Forum standards, see the Standards table in the
“
Additional
References
”
section.
Relationship Between ACLs and Ethernet Infrastructure
The following points capture the relationship between ACLs and Ethernet Infrastructure (EI):
•
ACLs can be directly applied on an EVC using the command-line interface (CLI). An ACL is applied
to a service instance, which is the instantiation of an EVC on a given port.
•
One ACL can be applied to more than one service instance at any time.
•
One service instance can have one ACL at most applied to it at any time. If a Layer 2 ACL is applied
to a service instance that already has a Layer 2 ACL, the new one replaces the old one.
•
Only named ACLs can be applied to service instances. The command syntax ACLs is retained; the
mac
access-list extended
command is used to create an ACL.
•
The
show ethernet service instance id id interface type number
detail command can be used to
provide details about ACLs on service instances.
Layer 2 Configuration Guide for Cisco NCS 4200 Series
26
Layer 2 Access Control Lists on EVCs
EVCs
