Cisco Catalyst 4500 Series Software Configuration Guide

62-37
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 62 Configuring Network Security with ACLs
Using PACL with VLAN Maps and Router ACLs
Each ACL type listed in Table 62-1 corresponds with these scenarios:
Scenario 1: Host A is connected to an interface in VLAN 20, which has an SVI configured. The interface
has input PACL configured, and the SVI has input Router ACL configured as shown in Figure 62-7:
Figure 62-7 Scenario 1: PACL Interaction with an Input Router ACL
If the interface access group mode is prefer port, then only the input PACL is applied on the ingress
traffic from Host A. If the mode is prefer VLAN, then only the input Router ACL is applied to ingress
traffic from Host A that requires routing. If the mode is merge, then the input PACL is first applied to
the ingress traffic from Host A, and the input Router ACL is applied on the traffic that requires routing.
Scenario 2: Host A is connected to an interface in VLAN 10, which has a VACL (VLAN Map)
configured and an input PACL configured as shown in Figure 62-8:
Table 62-1 Interaction between PACLs, VACLs, and Router ACLs
ACL Type(s) Input PACL
prefer port
mode
prefer vlan
mode
merge mode
1. Input Router ACL PACL applied Input Router
ACL applied
PACL, Input Router ACL (merged)
applied in order (ingress)
2. VAC L PAC L a p p l i e d VAC L
applied
PACL, VACL (merged) applied in order
(ingress)
3. VACL + Input Router
ACL
PACL applied VACL +
Input Router
ACL applied
PACL, VACL, Input Router ACL
(merged) applied in order (ingress)
Frame
Routing function
VLAN 10
Host A
(VLAN 10)
Packet
94092
Catalyst 4500 series switch
VLAN 20
Host B
(VLAN 20)
Input
PAC L
Input
router
ACL
Output
PAC L

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E