Cisco Catalyst 3750-X User Manual

37-33
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-21521-01
Chapter 37 Configuring Network Security with ACLs
Configuring VLAN Maps
Use the no vlan access-map name global configuration command to delete a map. Use the no vlan
access-map name number global configuration command to delete a single sequence entry from within
the map.
Use the no action
access-map configuration command to enforce the default action, which is to forward.
VLAN maps do not use the specific permit or deny keywords. To deny a packet by using VLAN maps,
crea
te an ACL that would match the packet, and set the action to drop. A permit in the ACL counts as a
match. A deny in the ACL means no match.
Examples of ACLs and VLAN Maps
These examples show how to create ACLs and VLAN maps that for specific purposes.
Example 1
This example shows how to create an ACL and a VLAN map to deny a packet. In the first map, any
packets that match the ip1 ACL (TCP packets) would be dropped. You first create the ip1ACL to permit
any TCP packet and no other packets. Because there is a match clause for IP packets in the VLAN map,
the default action is to drop any IP packet that does not match any of the match clauses.
Switch(config)# ip access-list extended ip1
Switch(config-ext-nacl)# permit tc
p any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map ma
p_1 10
Switch(config-access-map)# match i
p address ip1
Switch(config-access-map)# action
drop
This example shows how to create a VLAN map to permit a packet. ACL ip2 permits UDP packets and
any packets that match the ip2 ACL are forwarded. In this map, any IP packets that did not match any of
the previous ACLs (that is, packets that are not TCP packets or UDP packets) would get dropped.
Switch(config)# ip access-list extended ip2
Switch(config-ext-nacl)# permit ud
p any any
Switch(config-ext-nacl)# exit
Switch(config)# vlan access-map ma
p_1 20
Switch(config-access-map)# match i
p address ip2
Switch(config-access-map)# action forward
Step 4
match {ip | mac} address {name |
number} [name | number]
Match the packet (using either the IP or MAC address) against one or more
standard or extended access lists. Note that packets are only matched
against access lists of the correct protocol type. IP packets are matched
against standard or extended IP access lists. Non-IP packets are only
matched against named MAC extended access lists.
Step 5
end Return to global configuration mode.
Step 6
show running-config Display the access list configuration.
Step 7
copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose

Cisco Catalyst 3750-X Specifications

General

Switching Capacity	160 Gbps
Stacking Bandwidth	64 Gbps
Max Stacking Units	9
Layer Support	Layer 2 and Layer 3
Form Factor	Rack-mountable
DRAM	256 MB
Flash Memory	64 MB
Model	Cisco Catalyst 3750-X Series
Ports	24 or 48 10/100/1000 Ethernet ports
Uplink Interfaces	4 SFP or 2 SFP+
Features	StackWise Plus, EnergyWise
Image	IP Base or IP Services
Operating Temperature	0 to 40°C
Operating Humidity	10 to 85% noncondensing