Cisco 4500M

To Next Page

To Previous Page

35-21

Software Configuration Guide—Release 12.2(25)EW

OL-6696-01

Chapter 35 Configuring Network Security with ACLs

Using VLAN Maps with Router ACLs

Figure 35-5 Applying ACLs on Switched Packets

ACLs and Routed Packets

Figure 35-6 shows how ACLs are applied on routed packets. For routed packets, the ACLs are applied

in this order:

1. VLAN map for input VLAN

2. Input router ACL

3. Output router ACL

4. VLAN map for output VLAN

VLAN 10

map

Frame

Input

router

ACL

Output

router

ACL

Routing function

Catalyst 4500 series switch

VLAN 10 VLAN 20

Host C

(VLAN 10)

Host A

(VLAN 10)

VLAN 20

map

Packet

94156

Main Page

Default Chapter3
- Table of Contents3
- Related Documentation23
- Obtaining Documentation25
  - Ordering Documentation25
- Documentation Feedback26
- Obtaining Technical Assistance26
- Obtaining Additional Publications and Information27
- Layer 2 Software Features29
Chapter 1 Product Overview30
- Q and Layer 2 Protocol Tunneling30
- Storm Control30
- DHCP Snooping30
- Etherchannel Bundles31
- IP Source Guard31
- Jumbo Frames31
- Layer 2 Traceroute31
- Pvrst+32
- Spanning Tree Protocol32
- Udld33
- Unidirectional Ethernet33
- Vlans33
- Layer 3 Software Features34
Hsrp34
- IP Routing Protocols34
- Multicast Services37
- Network Security with Acls37
- Policy-Based Routing38
- Qos Features38
- Unidirectional Link Routing38
- VRF-Lite38
- Management and Security Features39
- Accessing the Switch CLI43
  - Accessing the CLI Using the EIA/TIA-232 Console Interface43
  - Accessing the CLI through Telnet44
Chapter 2 Command-Line Interface45
- Performing Command-Line Processing45
- Performing History Substitution45
- Understanding Cisco IOS Command Modes46
- Getting a List of Commands and Syntax47
- ROMMOM Command-Line Interface48
- Default Switch Configuration49
- Configuring DHCP-Based Autoconfiguration50
  - Understanding DHCP-Based Autoconfiguration50
Chapter 3 Configuring the Switch for the First Time51
- DHCP Client Request Process51
- Configuring the DHCP Server51
- Configuring the TFTP Server52
- Configuring the DNS Server53
- Configuring the Relay Device53
- Obtaining Configuration Files54
- Example Configuration55
- Configuring the Switch56
- Controlling Access to Privileged EXEC Commands61
- Recovering a Lost Enable Password66
- Modifying the Supervisor Engine Startup Configuration66
- Overview of Interface Configuration73
- Using the Interface Command74
Chapter 4 Configuring Interface75
- Configuring a Range of Interfaces76
- Defining and Using Interface-Range Macros77
- Configuring Optional Interface Features78
- Understanding Online Insertion and Removal85
- Monitoring and Maintaining the Interface85
CHAPTER 5 Checking Port Status and Connectivity89
- Checking Module Status89
- Checking Interfaces Status90
- C H a P T E R 5 Checking Port Status and Connectivity91
- Checking MAC Addresses91
- Using Telnet91
- Changing the Logout Timer92
- Monitoring User Sessions92
- Using Ping93
  - Understanding How Ping Works93
  - Running Ping94
- Using IP Traceroute95
  - Understanding How IP Traceroute Works95
  - Running IP Traceroute95
- Using Layer 2 Traceroute96
- Configuring ICMP98
CHAPTER 6 Configuring Supervisor Engine Redundancy Using RPR and SSO102
- Understanding Cisco IOS NSF-Awareness Support102
- Understanding Supervisor Engine Redundancy103
- Understanding Supervisor Engine Redundancy Synchronization106
  - RPR Supervisor Engine Configuration Synchronization106
  - SSO Supervisor Engine Configuration Synchronization107
- Supervisor Engine Redundancy Guidelines and Restrictions107
- Configuring Supervisor Engine Redundancy108
  - Configuring Redundancy108
  - Synchronizing the Supervisor Engine Configurations110
- Performing a Manual Switchover111
- Performing a Software Upgrade112
- Manipulating Bootflash on the Redundant Supervisor Engine114
Chapter 7 Environmental Monitoring and Power Management115
- Understanding Environmental Monitoring115
  - Using CLI Commands to Monitor Your Environment116
  - System Alarms116
- Power Management117
Chapter 8 Configuring Power over Ethernet131
- Power Management Modes131
- Configuring Power Consumption for Powered Devices on an Interface133
- Displaying the Operational Status for an Interface136
- Displaying the Poe Consumed by a Module137
CHAPTER 9 Configuring Switches with Web-Based Tools143
- Configuring and Using the Network Assistant143
- Clustering Switches152
  - Understanding Switch Clusters153
  - Using the CLI to Manage Switch Clusters155
- Configuring Embedded Ciscoview Support155
Chapter 10 Understanding and Configuring Vlans161
- Overview of Vlans161
- VLAN Configuration Guidelines and Restrictions163
  - VLAN Ranges163
  - Configurable Normal-Range VLAN Parameters164
- VLAN Default Configuration164
- Configuring Vlans164
CHAPTER 11 Configuring Dynamic VLAN Membership169
- Understanding VMPS169
- Understanding VMPS Clients172
CHAPTER 12 Configuring Layer 2 Ethernet Interfaces 12-1179
- Overview of Layer 2 Ethernet Switching179
- Default Layer 2 Ethernet Interface Configuration182
- Layer 2 Interface Configuration Guidelines and Restrictions183
- Configuring Ethernet Interfaces for Layer 2 Switching183
Chapter 13 Configuring Smartport Macros189
- Understanding Smartport Macros189
- Configuring Smart-Port Macros190
- Displaying Smartport Macros196
Chapter 14 Understanding and Configuring STP197
- Overview of STP197
- Default STP Configuration202
- Configuring STP203
Configuring Stp Features219
Chapter 15 Configuring STP Feature220
- Overview of Root Guard220
- Overview of Loop Guard220
- Overview of Portfast221
- Overview of BPDU Guard222
- Overview of Portfast BPDU Filtering222
- Overview of Uplinkfast223
- Overview of Backbonefast224
- Enabling Root Guard226
- Enabling Loop Guard227
- Enabling Portfast229
- Enabling BPDU Guard230
- Enabling Portfast BPDU Filtering230
- Enabling Uplinkfast232
- Enabling Backbonefast233
CHAPTER 16 Understanding and Configuring Multiple Spanning Trees235
- Overview of MST235
- MST Configuration Restrictions and Guidelines242
- Configuring MST243
CHAPTER 17 Understanding and Configuring Etherchannel251
- Overview of Etherchannel251
- Etherchannel Configuration Guidelines and Restrictions255
- Configuring Etherchannel256
CHAPTER 18 Configuring IGMP Snooping and Filtering265
- Overview of IGMP Snooping265
- Configuring IGMP Snooping268
- Displaying IGMP Snooping Information275
- Configuring IGMP Filtering280
- Displaying IGMP Filtering Configuration284
Chapter 19 Configuring 802.1Q and Layer 2 Protocol Tunneling287
- Understanding 802.1Q Tunneling287
- Configuring 802.1Q Tunneling290
- Understanding Layer 2 Protocol Tunneling293
- Configuring Layer 2 Protocol Tunneling295
- Monitoring and Maintaining Tunneling Status298
Chapter 20 Understanding and Configuring CDP299
- Overview of CDP299
- Configuring CDP300
Chapter 21 Configuring UDLD303
- Overview of UDLD303
- Default UDLD Configuration304
- Configuring UDLD on the Switch304
Chapter 22 Configuring Unidirectional Ethernet307
- Overview of Unidirectional Ethernet307
- Configuring Unidirectional Ethernet307
Chapter 23 Configuring Layer 3 Interfaces311
- Overview of Layer 3 Interfaces311
  - Logical Layer 3 VLAN Interfaces312
  - Physical Layer 3 Interfaces312
- Configuration Guidelines313
- Configuring Logical Layer 3 VLAN Interfaces313
- Configuring Physical Layer 3 Interfaces314
- Configuring Physical Layer 3 Interfaces315
Chapter 24 Configuring Cisco Express Forwarding317
- Overview of CEF317
- Catalyst 4500 Series Switch Implementation of CEF319
- CEF Configuration Restrictions322
- Configuring CEF322
  - Enabling CEF322
  - Configuring Load Balancing for CEF323
- Monitoring and Maintaining CEF324
  - Displaying IP Statistics324
Chapter 25 Understanding and Configuring IP Multicast327
- Overview of IP Multicast327
- Configuring IP Multicast Routing338
- Monitoring and Maintaining IP Multicast Routing341
- Configuration Examples347
Chapter 26 Configuring Policy-Based Routing349
- Overview of Policy-Based Routing349
- Policy-Based Routing Configuration Task List351
- Policy-Based Routing Configuration Examples353
Chapter 27 Understanding and Configuring VTP355
- Configuration Guidelines355
- Overview of VTP355
- VTP Configuration Guidelines and Restrictions359
- VTP Default Configuration359
- Configuring VTP360
Chapter 28 Configuring VRF-Lite365
- Understanding VRF-Lite366
- Default VRF-Lite Configuration367
- VRF-Lite Configuration Guidelines368
- Configuring Vrfs369
- Configuring a VPN Routing Session369
- Configuring BGP PE to CE Routing Sessions370
- VRF-Lite Configuration Example371
- Displaying VRF-Lite Status375
Chapter 29 Configuring Qos377
- Overview of Qos377
- Configuring Auto-Qos392
- Configuring Qos398
Chapter 30 Configuring Voice Interfaces425
- Overview of Voice Interfaces425
- Configuring a Port to Connect to a Cisco 7690 IP Phone426
- Configuring Voice Ports for Voice and Data Traffic426
- Overriding the Cos Priority of Incoming Frames427
- Configuring Inline Power428
Chapter 31 Understanding and Configuring 802.1X Port-Based Authentication429
- Understanding 802.1X Port-Based Authentication429
- How to Configure 802.1X439
- Displaying 802.1X Statistics and Status450
Chapter 32 Configuring Port Security451
- Overview of Port Security451
- Default Port Security Configuration453
- Port Security Guidelines and Restrictions453
- Configuring Port Security453
  - Configuring Port Security on an Interface454
  - Configuring Port Security Aging456
- Displaying Port Security Settings457
Chapter 33 Configuring DHCP Snooping and IP Source Guard459
- Overview of DHCP Snooping459
  - Overview of the DHCP Snooping Database Agent460
- Configuring DHCP Snooping on the Switch461
- Displaying DHCP Snooping Information467
  - Displaying a Binding Table468
  - Displaying the DHCP Snooping Configuration468
- Overview of IP Source Guard468
- Configuring IP Source Guard on the Switch469
  - Configuring IP Source Guard on Private Vlans470
- Displaying IP Source Guard Information471
- Displaying IP Source Binding Information472
Chapter 34 Understanding and Configuring Dynamic ARP Inspection473
- Overview of Dynamic ARP Inspection473
- Configuring Dynamic ARP Inspection477
  - Scenario One: Two Switches Support Dynamic ARP Inspection477
  - Scenario Two: One Switch Supports Dynamic ARP Inspection481
Chapter 35 Configuring Network Security with Acls483
- Understanding Acls483
- Hardware and Software ACL Support487
- TCAM Programming and Acls488
- Layer 4 Operators in Acls489
- Configuring Unicast MAC Address Filtering493
- Configuring Named MAC Extended Acls493
- Configuring VLAN Maps494
- Displaying VLAN Access Map Information501
- Using VLAN Maps with Router Acls501
  - Guidelines for Using Router Acls and VLAN Maps502
  - Examples of Router Acls and VLAN Maps Applied to Vlans502
- Configuring Pacls504
- Using PACL with VLAN Maps and Router Acls508
Chapter 36 Configuring Private Vlans511
- Overview of Pvlans511
  - PVLAN Trunks512
  - Pvlans and VLAN Acl/Qos512
- How to Configure Pvlans513
Chapter 37 Port Unicast and Multicast Flood Blocking523
- Overview of Flood Blocking523
- Configuring Port Blocking523
  - Blocking Flooded Traffic on an Interface524
  - Resuming Normal Forwarding on a Port525
Chapter 38 Configuring Port-Based Traffic Control527
- Overview of Storm Control527
  - Hardware-Based Storm Control Implementation528
  - Software-Based Storm Control Implementation528
- Enabling Storm Control529
- Disabling Storm Control530
- Displaying Storm Control530
- Multicast Storm Control532
  - Multicast Suppression on the WS-X4516 Supervisor Engine532
  - Multicast Suppression on the WS-X4515, WS-X4014, and WS-X4013+ Supervisor Engines533
Chapter 39 Configuring SPAN and RSPAN535
- Overview of SPAN and RSPAN535
- Configuring SPAN540
- CPU Port Sniffing544
- Encapsulation Configuration546
- Ingress Packets546
- Access List Filtering547
  - ACL Configuration Guidelines547
  - Configuring Access List Filtering548
- Packet Type Filtering548
- Configuration Example549
- Configuring RSPAN550
Chapter 40 Configuring Netflow Statistics Collection561
- Overview of Netflow Statistics Collection561
- Configuring Netflow Statistics Collection566
- Netflow Statistics Collection Configuration Example571
- Netflow Configuration Examples573
Appendix577
A Acronyms577
Appendix A Acronym578

Table of Contents

Other manuals for Cisco 4500M

Related product manuals