16-22
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
78-13315-02
Chapter 16 Configuring Access Control
Using VACLs in your Network
An explanation of the LOU usage follows:
•
LOU 1 stores “gt 10” and “lt 9”
•
LOU 2 stores “gt 11” and “neq 6”
•
LOU 3 stores “gt 20” (with space for one more)
•
LOU 4 stores “range 11 13” (range needs the entire LOU)
Using VACLs in your Network
This section describes some typical uses for VACLs and includes the following:
•
Wiring Closet Configuration, page 16-22
•
Redirecting Broadcast Traffic to a Specific Server Port, page 16-23
•
Restricting the DHCP Response for a Specific Server, page 16-24
•
Denying Access to a Server on Another VLAN, page 16-25
•
Restricting ARP Traffic, page 16-26
•
Configuring ACLs on Private VLANs, page 16-26
•
Capturing Traffic Flows, page 16-27
Wiring Closet Configuration
In a wiring closet configuration, Catalyst 6000 family switches might not be equipped with MSFCs
(routers). In this configuration, the switch can still support a VACL and a QoS ACL. Suppose Host X
and Host Y are in different VLANs and are connected to wiring closet Switch A and Switch C
(see
Figure 16-4
). Traffic from Host X to Host Y is eventually being routed by the switch equipped with
the MSFC. Traffic from Host X to Host Y can be access controlled at the traffic entry point, Switch A.
If you do not want HTTP traffic switched from Host X to Host Y, you can configure a VACL on
Switch A. All HTTP traffic from Host X to Host Y would be dropped at Switch A and not be bridged to
the switch with the MSFC.
