• The VTY ACL feature restricts all traffic for all VTY lines. You cannot specify different traffic restrictions
for different VTY lines. Any router ACL can be configured as a VTY ACL.
• When you apply an undefined ACL to an interface, the system treats the ACL as empty and permits all
traffic.
• IP tunnels do not support ACLs or QoS policies.
• The following guidelines apply to ACLs for VXLANs:
• Ingress port ACLs applied on a Layer 2 port for traffic in the access to network direction (Layer 2
to Layer 3 encapsulation path) are supported on the inner payload.
• We recommend using port ACLs on the access side to filter out traffic entering the overlay network.
• Ingress router ACLs applied on an uplink Layer 3 interface matching on the inner or outer payload
in the network to access direction (Layer 3 to Layer 2 decapsulation path) are not supported.
• Egress router ACLs applied on an uplink Layer 3 interface matching on the inner or outer payload
in the access to network direction (encapsulation path) are not supported.
• Cisco Nexus 9300 and 9500 Series switches, and Cisco Nexus 9200 and 9300-EX Series switches have
the following limitations for ACL options that can be used on VXLAN traffic:
• Does not support egress port ACLs applied on a Layer 2 port for traffic in the network to access
direction (decapsulation path).
• Supports ingress VACLs applied on a VLAN for traffic in the access to network direction
(encapsulation path).
• Supports egress VACLs applied on a VLAN for traffic in the network to access direction
(decapsulation path).
• Supports ingress RACLs applied on a tenant or server facing SVI for traffic in the access to network
direction (encapsulation path).
• Supports egress RACLs applied on a tenant or server facing SVI for traffic in the network to access
direction (decapsulation path).
• IPv6 ACL logging is not supported.
• IPv4 ACL logging in the egress direction is not supported.
• ACL logging for VACLs is not supported.
• ACL logging applies to port ACLs configured by the
ip port access-group
command and to router ACLs
configured by the
ip access-group
command only.
• The total number of IPv4 ACL flows is limited to a user-defined maximum value to prevent DoS attacks.
If this limit is reached, no new logs are created until an existing flow finishes.
• The number of syslog entries generated by IPv4 ACL logging is limited by the configured logging level
of the ACL logging process. If the number of syslog entries exceeds this limit, the logging facility might
drop some logging messages. Therefore, IPv4 ACL logging should not be used as a billing tool or as an
accurate source of the number of matches to an ACL.
• Egress router ACLs are not supported on subinterfaces and on Cisco Nexus 9300 Series switch uplink
ports.
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
230
Configuring IP ACLs
Guidelines and Limitations for IP ACLs
