Cisco Catalyst 3750 Software Configuration Guide

25-35
Catalyst 3750 MetroSwitch Software Configuration Guide
78-15870-01
Chapter 25 Configuring Network Security with ACLs
Using VLAN Maps with Router ACLs
• Avoid including Layer 4 information in an ACL; adding this information complicates the merging
process. The best merge results are obtained if the ACLs are filtered based on IP addresses (source
and destination) and not on the full flow (source IP address, destination IP address, protocol, and
protocol ports). It is also helpful to use don’t care bits in the IP address, whenever possible.
If you need to specify the full-flow mode and the ACL contains both IP ACEs and TCP/UDP/ICMP
ACEs with Layer 4 information, put the Layer 4 ACEs at the end of the list. This gives priority to
the filtering of traffic based on IP addresses.
Examples of Router ACLs and VLAN Maps Applied to VLANs
This section gives examples of applying router ACLs and VLAN maps to a VLAN for switched, bridged,
routed, and multicast packets. Although the following illustrations show packets being forwarded to their
destination, each time the packet’s path crosses a line indicating a VLAN map or an ACL, it is also
possible that the packet might be dropped, rather than forwarded.
ACLs and Switched Packets
Figure 25-6 shows how an ACL is applied on packets that are switched within a VLAN. Packets switched
within the VLAN without being routed or forwarded by fallback bridging are only subject to the VLAN
map of the input VLAN.
Figure 25-6 Applying ACLs on Switched Packets
VLAN 10
map
Frame
Input
router
ACL
Output
router
ACL
Routing function or
fallback bridge
VLAN 10 VLAN 20
Host C
(VLAN 10)
Host A
(VLAN 10)
VLAN 20
map
Packet
101357

Cisco Catalyst 3750 Specifications

General

Device Type	Switch
Switching Capacity	32 Gbps
Forwarding Rate	38.7 Mpps
Stacking Bandwidth	32 Gbps
RAM	128 MB
Jumbo Frame Support	Yes
Switch Type	Managed
Model	Catalyst 3750 Series
Uplink Interfaces	SFP
Form Factor	Rack-mountable
MAC Address Table Size	12, 000 entries
Routing Protocol	RIP, OSPF, EIGRP
Remote Management Protocol	SNMP, Telnet, HTTP
Features	Layer 3 switching, Layer 2 switching, auto-negotiation, BOOTP support, ARP support, VLAN support, auto-uplink (auto MDI/MDI-X), IGMP snooping, traffic shaping, MAC address filtering, Quality of Service (QoS), Jumbo Frames support, MLD snooping, Dynamic ARP Inspection (DAI), Cisco EnergyWise technology
Power over Ethernet (PoE)	PoE
Operating Temperature	-5 - 45 °C
Operating Humidity	10% to 85% non-condensing