Configuration Examples for Using VLAN Maps in Your Network
Example: Wiring Closet Configuration
In a wiring closet configuration, routing might not be enabled on the switch. In this configuration, the switch
can still support a VLAN map and a QoS classification ACL. Assume that Host X and Host Y are in different
VLANs and are connected to wiring closet switches A and C. Traffic from Host X to Host Y is eventually
being routed by Switch B, a Layer 3 switch with routing enabled. Traffic from Host X to Host Y can be
access-controlled at the traffic entry point, Switch A.
Figure 6: Wiring Closet Configuration
If you do not want HTTP traffic switched from Host X to Host Y, you can configure a VLAN map on Switch
A to drop all HTTP traffic from Host X (IP address 10.1.1.32) to Host Y (IP address 10.1.1.34) at Switch A
and not bridge it to Switch B.
First, define the IP access list http that permits (matches) any TCP traffic on the HTTP port.
Switch(config)# ip access-list extended http
Switch(config-ext-nacl)# permit tcp host 10.1.1.32 host 10.1.1.34 eq www
Switch(config-ext-nacl)# exit
Next, create VLAN access map map2 so that traffic that matches the http access list is dropped and all other
IP traffic is forwarded.
Switch(config)# vlan access-map map2 10
Switch(config-access-map)# match ip address http
Switch(config-access-map)# action drop
Switch(config-access-map)# exit
Switch(config)# ip access-list extended match_all
Switch(config-ext-nacl)# permit ip any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map map2 20
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 149
Configuring IPv4 ACLs
Configuration Examples for Using VLAN Maps in Your Network
To Next Page
Loading...
Need help?
General
