2-238
Catalyst 3750-X and 3560-X Switch Command Reference
OL-29704-01
Chapter 2 Catalyst 3750-X and 3560-X Switch Cisco IOS Commands
ip access-group
• An IP ACL applied to a Layer 2 interface only filters IP packets. To filter non-IP packets, use the
mac access-group interface configuration command with MAC extended ACLs.
You can use router ACLs, input port ACLs, and VLAN maps on the same switch. However, a port ACL
takes precedence over a router ACL or VLAN map:
• When an input port ACL is applied to an interface and a VLAN map is applied to a VLAN that the
interface is a member of, incoming packets received on ports with the ACL applied are filtered by
the port ACL. Other packets are filtered by the VLAN map.
• When an input router ACL and input port ACLs exist in an switch virtual interface (SVI), incoming
packets received on ports to which a port ACL is applied are filtered by the port ACL. Incoming
routed IP packets received on other ports are filtered by the router ACL. Other packets are not
filtered.
• When an output router ACL and input port ACLs exist in an SVI, incoming packets received on the
ports to which a port ACL is applied are filtered by the port ACL. Outgoing routed IP packets are
filtered by the router ACL. Other packets are not filtered.
• When a VLAN map, input router ACLs, and input port ACLs exist in an SVI, incoming packets
received on the ports to which a port ACL is applied are only filtered by the port ACL. Incoming
routed IP packets received on other ports are filtered by both the VLAN map and the router ACL.
Other packets are filtered only by the VLAN map.
• When a VLAN map, output router ACLs, and input port ACLs exist in an SVI, incoming packets
received on the ports to which a port ACL is applied are only filtered by the port ACL. Outgoing
routed IP packets are filtered by both the VLAN map and the router ACL. Other packets are filtered
only by the VLAN map.
You can apply IP ACLs to both outbound or inbound Layer 3 interfaces.
A Layer 3 interface can have one IP ACL applied in each direction.
You can configure only one VLAN map and one router ACL in each direction (input/output) on a VLAN
interface.
For standard inbound access lists, after the switch receives a packet, it checks the source address of the
packet against the access list. IP extended access lists can optionally check other fields in the packet,
such as the destination IP address, protocol type, or port numbers. If the access list permits the packet,
the switch continues to process the packet. If the access list denies the packet, the switch discards the
packet. If the access list has been applied to a Layer 3 interface, discarding a packet (by default) causes
the generation of an Internet Control Message Protocol (ICMP) Host Unreachable message. ICMP Host
Unreachable messages are not generated for packets discarded on a Layer 2 interface.
For standard outbound access lists, after receiving a packet and sending it to a controlled interface, the
switch checks the packet against the access list. If the access list permits the packet, the switch sends the
packet. If the access list denies the packet, the switch discards the packet and, by default, generates an
ICMP Host Unreachable message.
If the specified access list does not exist, all packets are passed.
Examples This example shows how to apply IP access list 101 to inbound packets on a port:
Switch(config)# interface gigabitethernet1/0/1
Switch(config-if)# ip access-group 101 in
You can verify your settings by entering the show ip interface, show access-lists, or show ip
access-lists privileged EXEC command.
To Next Page
Loading...
Need help?
General
