Cisco Catalyst 3550 Series User Manual

28-34
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-09
Chapter 28 Configuring Network Security with ACLs
Configuring VLAN Maps
Figure 28-4 Wiring Closet Configuration
If you do not want HTTP traffic switched from Host X to Host Y, you can configure a VLAN map on
Switch A to drop all HTTP traffic from Host X (IP address 10.1.1.32) to Host Y (IP address 10.1.1.34)
at Switch A and not bridge it to Switch B.
First, define the IP access list http that permits (matches) any TCP traffic on the HTTP port.
Switch(config)# ip access-list extended http
Switch(config-ext-nacl)# permit tcp host 10.1.1.32 host 10.1.1.34 eq www
Switch(config-ext-nacl)# exit
Next, create VLAN access map map2 so that traffic that matches the http access list is dropped and all
other IP traffic is forwarded.
Switch(config)# vlan access-map map2 10
Switch(config-access-map)# match ip address http
Switch(config-access-map)# action drop
Switch(config-access-map)# exit
Switch(config)# ip access-list extended match_all
Switch(config-ext-nacl)# permit ip any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map map2 20
Switch(config-access-map)# match ip address match_all
Switch(config-access-map)# action forward
Then, apply VLAN access map map2to VLAN 1.
Switch(config)# vlan filter map2 vlan 1
Catalyst 3550 switch
Switch A Switch C
Switch B
VLAN map: Deny HTTP
from X to Y.
HTTP is dropped
at entry point.
Host X
10.1.1.32
Host Y
10.1.1.34
VLAN 1
VLAN 2
Packet
86304
Si

Cisco Catalyst 3550 Series Specifications

General

Form Factor	Rack-mountable
Manageable	Yes
RAM	64 MB
Device Type	Switch
MAC Address Table Size	12000 entries
Routing Protocol	RIP
Features	VLAN support
Power Supply	AC 120/230 V (50/60 Hz)
Ports	24 or 48 x 10/100Base-TX, 1 x GBIC, 2 x 10/100/1000Base-T
Operating Temperature	32 to 113°F (0 to 45°C)