16-16
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
78-13315-02
Chapter 16 Configuring Access Control
Using VACLs with Cisco IOS ACLs
Guidelines for Configuring Cisco IOS ACLs and VACLs on the Same VLAN
Interface
Follow these guidelines when you need to configure a Cisco IOS ACL
and
a VACL on the same VLAN.
These guidelines do not apply to configurations where you are mapping Cisco IOS ACLs and VACLs on
different VLANs.
The Catalyst 6000 family switch hardware provides one lookup for security ACLs for each direction
(input and output); you must merge a Cisco IOS ACL and a VACL when they are configured on the same
VLAN. Merging the Cisco IOS ACL with the VACL might significantly increase the number of ACEs.
If you must configure a Cisco IOS ACL and a VACL on the same VLAN, use the following guidelines
for both Cisco IOS ACL and VACL configuration.
Note
To display the percentage of ACL storage being used, enter the
show security acl resource-usage
command.
These sections provide Cisco IOS ACL and VACL configuration guidelines and examples:
•
Using the Implicit Deny Action, page 16-16
•
Grouping Actions Together, page 16-16
•
Limiting the Number of Actions, page 16-16
•
Avoiding Layer 4 Port Information, page 16-17
•
Estimating Merge Results, page 16-17
•
Examples, page 16-17
Using the Implicit Deny Action
If possible, use the implicit deny action at the end of an ACL (deny any any) and define ACEs to permit
only allowed traffic. You can achieve this same effect by defining all the deny entries, and at the end of
the list specifying
permit ip any any
(see
Example 1, page 16-17
).
Grouping Actions Together
To define multiple actions in an ACL (permit, deny, redirect), group each action type together.
Example 3, page 16-18
shows what can happen when you do not group each type together. In the
example, the deny action in line 6 was grouped with permit actions. If this deny action is removed, the
result of merging would be 53 entries, instead of 329.
Limiting the Number of Actions
An ACL with only permit ACEs has two actions: permit and deny (because of the implicit deny at the
end of the list). An ACL with permit and redirect has three actions: permit, redirect, and deny (because
of the implicit deny at the end of the list).
When configuring an ACL, the best merge results are obtained when you specify only two different
actions: permit and deny, redirect and permit, or redirect and deny.
