Cisco WS-X6248-RJ-45 - Catalyst 6000 Expansion Module Manual de usuario descargar pdf (Pagina 27)

Cisco Systems, Inc.

Page 27 of 42

Access Control Lists (ACLs)

Cisco Catalyst 6500 Series running Hybrid OS support the following types of ACLs:

• IOS Routing ACLs (RACLs) provide access control for routed trafﬁc between VLANs. Standard and extended

IOS ACLs are conﬁgured on the input and output of routerinterfaces and,as such, are appliedto routedpackets.

The use of IOS ACLs requires both a PFCx and a MSFCx on the Cisco Catalyst 6500 Series.

• VLAN ACLs (VACLs) provide access control based on Layer 3 or Layer 4 information for IP or IPX protocols.

A VACL is applied to all packets (bridged and routed) on a VLAN and can be conﬁgured on any VLAN interface.

VACL functionality requires a PFCx.

• QoS ACLs are used to identify ingress trafﬁc which should be marked or policed upon entering a port or VLAN.

QoS ACL functionality requires a PFCx.

IOS RACLs have the same implementation in Hybrid as in Cisco IOS (whether on the Cisco Catalyst 6500 or any

other IOS router). QoS ACLs for both operating systems are covered in the QoS section of this white paper. This

section describes the differences between the VACL implementation in CatOS and Cisco IOS Software.

VLAN Access Control Lists (VACLs)

For CatOS, conﬁguring a security ACL statement creates a VACL. This statement is used to conﬁgure all match and

action parameters for the security policy.

The VACL conﬁguration in Cisco IOS is based on the traditional IOS ACL implementation. That is, it relies on the

IOS access-list command to deﬁne the trafﬁc matching parameters. From there, all conﬁguration (including ACL

reference and action) is done from the “vlan access-map” conﬁguration mode. Although the Cisco IOS action is a

CLI concept which is not present in CatOS, it provides similar capture, log, and redirect functionality. Refer to the

user documentation for speciﬁcs on these options. The following provides a general comparison between VACL

conﬁguration between CatOS and Cisco IOS.

Note:

When creating a VACL in IOS, a SVI for that VLAN interface is created. While this interface is required, it

is not necessary for the interface to be conﬁgured or even in an “up” state for the VACL to operate properly.

When an ACL is created, modiﬁed, or deleted, the changes exist temporarily in an edit buffer in memory. CatOS

requires that the ACL be committed for it to take effect. Cisco IOS Software does not utilize the edit buffer concept.

Once a policy has been built in IOS, it must then be mapped to a VLAN or interface for that ACL to take effect.

CatOS Cisco IOS Software

set vlan 10

set security acl ip sample permit ip any

commit security acl sample

set security acl map sample 10

vlan 10

access-list 101 permit ip any any

vlan access-map sample

match ip address 101

action forward

vlan filter sample vlan-list 10

1 2 ... 22 23 24 25 26 27 28 29 30 31 32 ... 41 42

Sin comentarios

Cisco WS-X6248-RJ-45 - Catalyst 6000 Expansion Module Manual de usuario Pagina 27