16-23
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
78-13315-02
Chapter 16 Configuring Access Control
Using VACLs in your Network
Figure 16-4 Wiring Closet Configuration
Redirecting Broadcast Traffic to a Specific Server Port
Some application traffic uses broadcast packets that reach every host in a VLAN. With VACLs, you can
redirect these broadcast packets to the intended application server port.
Figure 16-5
shows an application broadcast packet from Host A being redirected to the target application
server port and preventing other ports from receiving the packet.
To redirect broadcast traffic to a specific server port, perform this task in privileged mode (TCP
port 5000 is the intended server application port):
Note
You could apply the same concept to direct broadcast traffic to a multicast destination by redirecting
the traffic to a group of ports (see
Figure 16-5
).
Catalyst 6500 series switches
with MSFC
Switch A
with PFC only
Switch C
with PFC only
VACL: deny http
from X to Y
http is dropped
at entry point
Host X
Host Y
VLAN 1
VLAN 2
Packet
26959
Task
Command
Step 1
Redirect the broadcast packets.
set security acl ip SERVER redirect 4/1 tcp any host
255.255.255.255 eq 5000
Step 2
Permit all other traffic.
set security acl ip SERVER permit ip any any
Step 3
Commit the VACL.
commit security acl SERVER
Step 4
Map the VACL to VLAN 10.
set security acl map SERVER 10
