tech:network:cisco:acl:vacl:vacl
Table of Contents
Cisco VACL
Blueprint
- CCIE R&S
- Written v5.1
- 5.0 Infrastructure Security
- 5.2 Network security
- 5.2.a [i] VACL, PACL
- Lab v5.0
- 5.0 Infrastructure Security
- 5.2 Network security
- 4.2.a [i] VACL, PACL
Physical Lab
Base Configuration
- SW1
configure terminal ! vtp mode transparent ! vlan 128-130 exit ! ip routing ! spanning-tree portfast default ! interface Vlan 128 ip address 10.0.128.1 255.255.255.0 no shutdown exit interface Vlan 129 ip address 10.0.129.1 255.255.255.0 no shutdown exit interface Vlan 130 ip address 10.0.130.1 255.255.255.0 no shutdown exit interface FastEthernet 1/0/1 switchport mode access switchport access vlan 128 exit interface FastEthernet 1/0/2 switchport mode access switchport access vlan 130 exit interface FastEthernet 1/0/4 switchport mode access switchport access vlan 129 exit interface FastEthernet 1/0/5 switchport mode access switchport access vlan 128 exit ! end
- R1
configure terminal ! interface FastEthernet 0/0 ip address 10.0.128.101 255.255.255.0 no shutdown exit ! ip route 0.0.0.0 0.0.0.0 10.0.128.1 ! line vty 0 15 privilege level 15 password kotone login exit ! end
- R2
configure terminal ! interface FastEthernet 0/0 ip address 10.0.130.102 255.255.255.0 no shutdown exit ! ip route 0.0.0.0 0.0.0.0 10.0.130.1 ! line vty 0 15 privilege level 15 password kotone login exit ! end
VACL Configuration
- SW1
configure terminal ! access-list 101 permit ip 10.0.129.0 0.0.0.255 any ! mac access-list extended DBSV permit host 001b.2a77.66d2 any exit ! vlan access-map V-MAP 10 match ip address 101 action drop exit vlan access-map V-MAP 20 match mac address DBSV action drop exit vlan access-map V-MAP 30 action forward exit ! vlan filter V-MAP vlan-list 128 ! end
vlan filter V-MAP vlan-list 128, 130
Verification
SW1>enable
SW1#
*Mar 1 00:17:23.668: %LINK-3-UPDOWN: Interface FastEthernet1/0/1, changed state to up
*Mar 1 00:17:24.675: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/1, changed state to up
SW1#
*Mar 1 00:17:42.668: %LINK-3-UPDOWN: Interface FastEthernet1/0/2, changed state to up
*Mar 1 00:17:43.675: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/2, changed state to up
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#do sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa1/0/1, Fa1/0/2, Fa1/0/3
Fa1/0/4, Fa1/0/5, Fa1/0/6
Fa1/0/7, Fa1/0/8, Fa1/0/9
Fa1/0/10, Fa1/0/11, Fa1/0/12
Fa1/0/13, Fa1/0/14, Fa1/0/15
Fa1/0/16, Fa1/0/17, Fa1/0/18
Fa1/0/19, Fa1/0/20, Fa1/0/21
Fa1/0/22, Fa1/0/23, Fa1/0/24
Gi1/0/1, Gi1/0/2
128 VLAN0128 active
129 VLAN0129 active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1 enet 100001 1500 - - - - - 0 0
128 enet 100128 1500 - - - - - 0 0
SW1(config)#vt
SW1(config)#vtp mo
SW1(config)#vtp mode tra
SW1(config)#vtp mode transparent
Device mode already VTP Transparent for VLANS.
SW1(config)#vla
SW1(config)#vlan 128-130
SW1(config-vlan)#exit
SW1(config)#ip rou
SW1(config)#ip routi
SW1(config)#ip routing
SW1(config)#spa
SW1(config)#spanning-tree po
SW1(config)#spanning-tree portfast defa
SW1(config)#spanning-tree portfast default
%Warning: this command enables portfast by default on all interfaces. You
should now disable portfast explicitly on switched ports leading to hubs,
switches and bridges as they may create temporary bridging loops.
SW1(config)#int vlan 128
SW1(config-if)#ip add
SW1(config-if)#ip address
*Mar 1 00:41:38.286: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan128, changed state to down
SW1(config-if)#ip address 10.0.128.1 255.255.255.0
SW1(config-if)#int vlan 129
SW1(config-if)#ip add
*Mar 1 00:46:59.973: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan129, changed state to down
SW1(config-if)#ip add 10.0.129.1 255.255.255.0
SW1(config-if)#no shut
SW1(config-if)#int vlan 128
SW1(config-if)#no shut
SW1(config-if)#int vlan 130
SW1(config-if)#
*Mar 1 00:47:25.466: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to down
SW1(config-if)#ip addre 10.0.130.1 255.255.255.0
SW1(config-if)#no shut
SW1(config-if)#int f1/0/1
SW1(config-if)#swi
SW1(config-if)#switchport mo
SW1(config-if)#switchport mode a
SW1(config-if)#switchport mode access
SW1(config-if)#int range f1/0/5
SW1(config-if-range)#swi
SW1(config-if-range)#switchport mo
SW1(config-if-range)#int range f1/0/1-5
SW1(config-if-range)#swi
SW1(config-if-range)#switchport mo
SW1(config-if-range)#switchport mode ac
SW1(config-if-range)#switchport mode access
SW1(config-if-range)#exit
SW1(config)#int f1/0/1
SW1(config-if)#swi
SW1(config-if)#switchport mo
SW1(config-if)#switchport mode ac
SW1(config-if)#switchport mode access vla
SW1(config-if)#switchport mode access vlan
SW1(config-if)#switchport ac
SW1(config-if)#switchport access vl
SW1(config-if)#switchport access vlan 128
SW1(config-if)#int
*Mar 1 00:48:57.833: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan128, changed state to up
SW1(config-if)#int f1/0/5
SW1(config-if)#sw
SW1(config-if)#switchport mo
SW1(config-if)#switchport mode ac
SW1(config-if)#switchport mode access vl
SW1(config-if)#switchport ac
SW1(config-if)#switchport access vla
SW1(config-if)#switchport access vlan 128
SW1(config-if)#int f1/0/2
SW1(config-if)#sw
SW1(config-if)#switchport mo
SW1(config-if)#switchport mode ac
SW1(config-if)#switchport ac
SW1(config-if)#switchport access vl
SW1(config-if)#switchport access vlan 130
SW1(config-if)#
*Mar 1 00:49:44.582: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to up
SW1(config-if)#int f1/0/4
SW1(config-if)#sw
SW1(config-if)#switchport ac
SW1(config-if)#switchport access vla
SW1(config-if)#switchport access vlan 129
SW1(config-if)#
*Mar 1 00:50:05.462: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan129, changed state to up
SW1(config-if)#^Z
SW1#
*Mar 1 00:50:09.463: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh ip ro
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override
Gateway of last resort is not set
10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C 10.0.128.0/24 is directly connected, Vlan128
L 10.0.128.1/32 is directly connected, Vlan128
C 10.0.129.0/24 is directly connected, Vlan129
L 10.0.129.1/32 is directly connected, Vlan129
C 10.0.130.0/24 is directly connected, Vlan130
L 10.0.130.1/32 is directly connected, Vlan130
SW1#sh clock\
^
% Invalid input detected at '^' marker.
SW1#sh clock
*00:51:06.807 UTC Mon Mar 1 1993
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#ntp ma
SW1(config)#ntp ser
SW1(config)#ntp server 10.0.128.254
SW1(config)#ntp up
SW1(config)#ntp upda
SW1(config)#ntp up?
% Unrecognized command
SW1(config)#^Z
SW1#sh dcl
*Mar 1 00:51:31.076: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh clock
*22:00:43.979 UTC Tue Aug 27 2019
SW1#sh sta
SW1#sh clock detai
22:00:54.632 UTC Tue Aug 27 2019
Time source is NTP
SW1#sh stat
SW1#sh ntp status
Clock is synchronized, stratum 3, reference is 10.0.128.254
nominal freq is 119.2092 Hz, actual freq is 119.2092 Hz, precision is 2**17
reference time is E1102696.88CE02B0 (22:00:54.534 UTC Tue Aug 27 2019)
clock offset is 0.5069 msec, root delay is 8.79 msec
root dispersion is 7939.38 msec, peer dispersion is 7937.50 msec
loopfilter state is 'CTRL' (Normal Controlled Loop), drift is 0.000000001 s/s
system poll interval is 64, last update was 18 sec ago.
SW1#sh clock
22:01:16.921 UTC Tue Aug 27 2019
SW1#sh clock
22:01:18.590 UTC Tue Aug 27 2019
SW1#sh clock
22:01:19.748 UTC Tue Aug 27 2019
SW1#sh clock
22:01:20.645 UTC Tue Aug 27 2019
SW1#sh clock
22:01:21.342 UTC Tue Aug 27 2019
SW1#sh clock
22:01:21.979 UTC Tue Aug 27 2019
SW1#sh clock
22:01:22.701 UTC Tue Aug 27 2019
SW1#sh clock
22:01:24.538 UTC Tue Aug 27 2019
SW1#sh clock
22:01:25.628 UTC Tue Aug 27 2019
SW1#sh clock
22:01:26.484 UTC Tue Aug 27 2019
SW1#sh clock
22:01:27.189 UTC Tue Aug 27 2019
SW1#sh clock
22:01:28.220 UTC Tue Aug 27 2019
SW1#sh clock
22:01:28.866 UTC Tue Aug 27 2019
SW1#sh clock
22:01:29.487 UTC Tue Aug 27 2019
SW1#sh clock
22:01:30.167 UTC Tue Aug 27 2019
SW1#sh clock
22:01:30.821 UTC Tue Aug 27 2019
SW1#sh clcok
^
% Invalid input detected at '^' marker.
SW1#sh clock\
^
% Invalid input detected at '^' marker.
SW1#sh clock
22:04:37.979 UTC Tue Aug 27 2019
SW1#?
Exec commands:
access-enable Create a temporary Access-List entry
access-profile Apply user-profile to interface
access-template Create a temporary Access-List entry
archive manage archive files
beep Blocks Extensible Exchange Protocol commands
call-home Call-Home commands
cd Change current directory
clear Reset functions
clock Manage the system clock
cns CNS agents
configure Enter configuration mode
connect Open a terminal connection
copy Copy from one file to another
crypto Encryption related commands.
cts Cisco Trusted Security Exec Commands
debug Debugging functions (see also 'undebug')
delete Delete a file
diagnostic Diagnostic commands
dir List files on a filesystem
disable Turn off privileged commands
disconnect Disconnect an existing network connection
Press RETURN for another line, SPACE for another page, anything else to quit
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#acc
SW1(config)#access-li
SW1(config)#access-list 101 permi
SW1(config)#access-list 101 permit ip 10.0.129.0 0.0.0.255 an
SW1(config)#access-list 101 permit ip 10.0.129.0 0.0.0.255 any
SW1(config)#ma
SW1(config)#mac acc
SW1(config)#mac access-list exte
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#permi
SW1(config-ext-macl)#permit ho
SW1(config-ext-macl)#permit host ?
H.H.H 48-bit source MAC address
SW1(config-ext-macl)#permit host 001b.2a77.66d2 an
SW1(config-ext-macl)#permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#exit
SW1(config)#vlan acce
SW1(config)#vlan access-m
SW1(config)#vlan access-map V-MAP 10
SW1(config-access-map)#ma
SW1(config-access-map)#match ip
SW1(config-access-map)#match ip add
SW1(config-access-map)#match ip address 101
SW1(config-access-map)#ac
SW1(config-access-map)#action dr
SW1(config-access-map)#action drop
SW1(config-access-map)#vlan access-ma V-MAP 20
SW1(config-access-map)#mat
SW1(config-access-map)#match ma
SW1(config-access-map)#match mac add
SW1(config-access-map)#match mac address DBSV
SW1(config-access-map)#ac
SW1(config-access-map)#action dr
SW1(config-access-map)#action drop
SW1(config-access-map)#exit
SW1(config)#vlan acc
SW1(config)#vlan access-ma
SW1(config)#vlan access-map V-MAP 30
SW1(config-access-map)#actio
SW1(config-access-map)#action for
SW1(config-access-map)#action forward
SW1(config-access-map)#exit
SW1(config)#vla
SW1(config)#vlan fil
SW1(config)#vlan filter V-MAP vla
SW1(config)#vlan filter V-MAP vlan-list ?
<1-4094> VLAN id
all Add this filter to all VLANs
SW1(config)#vlan filter V-MAP vlan-list 128 ?
, comma
- hyphen
<cr>
SW1(config)#vlan filter V-MAP vlan-list 128
SW1(config)#no vlan filter V-MAP vlan-list 128
SW1(config)#vlan filter V-MAP vlan-list 128
SW1(config)#no vlan filter V-MAP vlan-list 128
SW1(config)#vlan filter V-MAP vlan-list 128
SW1(config)#^Z
SW1#sh
Aug 27 22:16:06.224: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh vlan acc
SW1#sh vlan access-m
SW1#sh vlan access-map
Vlan access-map "V-MAP" 10
Match clauses:
ip address: 101
Action:
drop
Vlan access-map "V-MAP" 20
Match clauses:
mac address: DBSV
Action:
drop
Vlan access-map "V-MAP" 30
Match clauses:
Action:
forward
SW1#sh vlan filter
VLAN Map V-MAP is filtering VLANs:
128
SW1#sh acc
SW1#sh access-li
SW1#sh access-lists
Extended IP access list 101
10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV
permit host 001b.2a77.66d2 any
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#swi
SW1(config)#switch ac
SW1(config)#switch ace
SW1(config)#switch acce
SW1(config)#vl
SW1(config)#vlan fi
SW1(config)#vlan filter V-MAP vlan
SW1(config)#vlan filter V-MAP vlan-list 128,130
SW1(config)#do sh run vlan filter
Building configuration...
Command rejected: Bad VLAN list - character #1 is a non-numeric
character ('f').
Current configuration:
end
SW1(config)#do sh run | vlan filter
^
% Invalid input detected at '^' marker.
SW1(config)#do sh run | i vlan filter
vlan filter V-MAP vlan-list 128,130
SW1(config)#manc acc
SW1(config)#manc acce
SW1(config)#manc access
SW1(config)#mac acce
SW1(config)#mac access-list ex
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#pe
SW1(config-ext-macl)#permit an
SW1(config-ext-macl)#permit any ho
SW1(config-ext-macl)#permit any host 0024.c431.126e
SW1(config-ext-macl)#^Z
SW1#sh
Aug 27 22:30:17.504: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh vlan access-map
Vlan access-map "V-MAP" 10
Match clauses:
ip address: 101
Action:
drop
Vlan access-map "V-MAP" 20
Match clauses:
mac address: DBSV
Action:
drop
Vlan access-map "V-MAP" 30
Match clauses:
Action:
forward
SW1#sh acce
SW1#sh access-li
SW1#sh access-lists
Extended IP access list 101
10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV
permit host 001b.2a77.66d2 any
permit any host 0024.c431.126e
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int f1/0/2
SW1(config-if)#swi
SW1(config-if)#switchport mo
SW1(config-if)#switchport a
SW1(config-if)#switchport ac
SW1(config-if)#switchport access vl
SW1(config-if)#switchport access vlan 128
SW1(config-if)#
Aug 27 22:32:47.586: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to down
SW1(config-if)#exit
SW1(config)#swi
SW1(config)#mac
SW1(config)#mac add
SW1(config)#mac acc
SW1(config)#mac access-list ex
SW1(config)#mac access-list ?
extended Extended Access List
SW1(config)#mac access-list ex
SW1(config)#mac access-list extended ?
WORD access-list name
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#no permit any host 0024.c431.126e
SW1(config-ext-macl)#do sh access-lists
Extended IP access list 101
10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV
permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#no per
SW1(config-ext-macl)#no permit ho
SW1(config-ext-macl)#exit
SW1(config)#ma
SW1(config)#vlan acc
SW1(config)#vlan access-?
WORD access-log access-map
SW1(config)#vlan access-ma
SW1(config)#vlan access-map V-MAP 20
SW1(config-access-map)#ac
SW1(config-access-map)#action for
SW1(config-access-map)#action forward
SW1(config-access-map)#action drop
SW1(config-access-map)#exit
SW1(config)#vlan acce
SW1(config)#vlan access-ma
SW1(config)#mac acc
SW1(config)#mac access-list ex
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#permi
SW1(config-ext-macl)#permit ho
SW1(config-ext-macl)#permit an
SW1(config-ext-macl)#permit any ho
SW1(config-ext-macl)#no permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#vlan access-map V-MAP 20
SW1(config-access-map)#ac
SW1(config-access-map)#action for
SW1(config-access-map)#action forward
SW1(config-access-map)#action drop
SW1(config-access-map)#mac access-list extended DBSV
SW1(config-ext-macl)#den
SW1(config-ext-macl)#deny an
SW1(config-ext-macl)#deny any an
SW1(config-ext-macl)#permi
SW1(config-ext-macl)#permit an
SW1(config-ext-macl)#permit any an
SW1(config-ext-macl)#permit any any
SW1(config-ext-macl)#no permit any any
SW1(config-ext-macl)#per
SW1(config-ext-macl)#permit any host 0024.c431.126e
SW1(config-ext-macl)#exit
SW1(config)#do sh vlan bri
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa1/0/3, Fa1/0/6, Fa1/0/7
Fa1/0/8, Fa1/0/9, Fa1/0/10
Fa1/0/11, Fa1/0/12, Fa1/0/13
Fa1/0/14, Fa1/0/15, Fa1/0/16
Fa1/0/17, Fa1/0/18, Fa1/0/19
Fa1/0/20, Fa1/0/21, Fa1/0/22
Fa1/0/23, Fa1/0/24, Gi1/0/1
Gi1/0/2
128 VLAN0128 active Fa1/0/1, Fa1/0/2, Fa1/0/5
129 VLAN0129 active Fa1/0/4
130 VLAN0130 active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
SW1(config)#do vlan filter
^
% Invalid input detected at '^' marker.
SW1(config)#do sh vlan filter
VLAN Map V-MAP is filtering VLANs:
128,130
SW1(config)#do sh access-lists
Extended IP access list 101
10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV
permit any host 0024.c431.126e
SW1(config)#sh ac
SW1(config)#do sh acc
SW1(config)#do sh access-li
SW1(config)#do sh access-lists ?
<1-2799> ACL number
WORD ACL name
hardware Show access-list hardware info
ipc Show access-list config download info
rate-limit Show rate-limit access lists
| Output modifiers
<cr>
SW1(config)#do sh vlan acc
SW1(config)#do sh vlan access-ma
SW1(config)#do sh vlan access-map
Vlan access-map "V-MAP" 10
Match clauses:
ip address: 101
Action:
drop
Vlan access-map "V-MAP" 20
Match clauses:
mac address: DBSV
Action:
drop
Vlan access-map "V-MAP" 30
Match clauses:
Action:
forward
SW1(config)#vlan fi
SW1(config)#vlan filter V-MAP vla
SW1(config)#vlan filter V-MAP vlan-list 128
SW1(config)#no vlan filter V-MAP vlan-list 128
SW1(config)#vlan filter V-MAP vlan-list 128
SW1(config)#^Z
SW1#sh
Aug 27 22:42:41.721: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh acce
SW1#sh access-li
SW1#sh access-lists
Extended IP access list 101
10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV
permit any host 0024.c431.126e
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int f1/0/1
SW1(config-if)#exit
SW1(config)#ma
SW1(config)#mac acc
SW1(config)#mac access-list ex
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#per
SW1(config-ext-macl)#permit ho
SW1(config-ext-macl)#permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#action forward
^
% Invalid input detected at '^' marker.
SW1(config-ext-macl)#vlan access-map V-MAP 20
SW1(config-access-map)#mat
SW1(config-access-map)#match ma
SW1(config-access-map)#match mac add
SW1(config-access-map)#match mac address DBSS
SW1(config-access-map)#match mac address DBSV
SW1(config-access-map)#acti
SW1(config-access-map)#action dr
SW1(config-access-map)#action drop
SW1(config-access-map)#do sh vlan-acc
SW1(config-access-map)#do sh vlan-access map
^
% Invalid input detected at '^' marker.
SW1(config-access-map)#do sh vlan access-map
Vlan access-map "V-MAP" 10
Match clauses:
ip address: 101
Action:
drop
Vlan access-map "V-MAP" 20
Match clauses:
mac address: DBSV DBSS
Action:
drop
Vlan access-map "V-MAP" 30
Match clauses:
Action:
forward
SW1(config-access-map)#no match mac address DBSV
% Ambiguous command: "no match mac address DBSV"
SW1(config-access-map)#no match mac address
SW1(config-access-map)#match mac address DBSV
SW1(config-access-map)#do sh vlan access-map
Vlan access-map "V-MAP" 10
Match clauses:
ip address: 101
Action:
drop
Vlan access-map "V-MAP" 20
Match clauses:
mac address: DBSV
Action:
drop
Vlan access-map "V-MAP" 30
Match clauses:
Action:
forward
SW1(config-access-map)#^Z
SW1#reload
Aug 27 22:48:26.310: %SYS-5-CONFIG_I: Configured from console by console
SW1#reload
System configuration has been modified. Save? [yes/no]: no
Proceed with reload? [confirm]
Aug 27 22:48:31.906: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload command.
(snip)
SW1>
SW1>
SW1>
*Mar 1 00:01:48.993: %PKI-6-AUTOSAVE: Running configuration saved to NVRAM
SW1>[OK]en
SW1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#!
SW1(config)#vtp mode transparent
Device mode already VTP Transparent for VLANS.
SW1(config)#!
SW1(config)#vlan 128-130
SW1(config-vlan)#exit
SW1(config)#!
SW1(config)#ip routing
SW1(config)#!
SW1(config)#spanning-tree portfast default
%Warning: this command enables portfast by default on all interfaces. You
should now disable portfast explicitly on switched ports leading to hubs,
switches and bridges as they may create temporary bridging loops.
SW1(config)#!
SW1(config)#interface Vlan 128
SW1(config-if)# ip address 10.0.128.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)#exit
SW1(config)#interface Vlan 129
SW1(config-if)# ip address 10.0.129.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)#exit
SW1(config)#interface Vlan 130
SW1(config-if)# ip address 10.0.130.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)#exit
SW1(config)#interface FastEthernet 1/0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 128
SW1(config-if)#exit
SW1(config)#interface FastEthernet 1/0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 130
SW1(config-if)#exit
SW1(config)#interface FastEthernet 1/0/4
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 129
SW1(config-if)#exit
SW1(config)#interface FastEthernet 1/0/5
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 128
SW1(config-if)#exit
SW1(config)#!
SW1(config)#end
SW1#
*Mar 1 00:02:25.533: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan128, changed state to down
*Mar 1 00:02:26.171: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan129, changed state to down
*Mar 1 00:02:26.205: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to down
*Mar 1 00:02:26.288: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan128, changed state to up
SW1# 1 00:02:26.347: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to up
*Mar 1 00:02:26.448: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan129, changed state to up
SW1#
*Mar 1 00:02:27.094: %SYS-5-CONFIG_I: Configured from console by console
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#acc
SW1(config)#access-li
SW1(config)#int f1/0/2
SW1(config-if)#swi
SW1(config-if)#switchport mo
SW1(config-if)#switchport ac
SW1(config-if)#switchport access vl
SW1(config-if)#switchport access vlan 128
SW1(config-if)#
*Mar 1 00:03:08.458: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to down
SW1(config-if)#exit
SW1(config)#acc
SW1(config)#access-li
SW1(config)#access-list 101 per
SW1(config)#access-list 101 permit ip 10.0.129.0 0.0.0.255 an
SW1(config)#access-list 101 permit ip 10.0.129.0 0.0.0.255 any
SW1(config)#ma
SW1(config)#mac acc
SW1(config)#mac access-list exte
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#permi
SW1(config-ext-macl)#permit ho
SW1(config-ext-macl)#permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#exit
SW1(config)#vlan acce
SW1(config)#vlan access-ma
SW1(config)#vlan access-map V-MAP 10
SW1(config-access-map)#mat
SW1(config-access-map)#match ip
SW1(config-access-map)#match ip add
SW1(config-access-map)#match ip address 101
SW1(config-access-map)#ac
SW1(config-access-map)#action dr
SW1(config-access-map)#action drop
SW1(config-access-map)#vlan access-map V-MAP 20
SW1(config-access-map)#mat
SW1(config-access-map)#match ma
SW1(config-access-map)#match mac add
SW1(config-access-map)#match mac address DBSV
SW1(config-access-map)#ac
SW1(config-access-map)#action dro
SW1(config-access-map)#action drop
SW1(config-access-map)#vlan access-map V-MAP 30
SW1(config-access-map)#actio
SW1(config-access-map)#action for
SW1(config-access-map)#action forward
SW1(config-access-map)#exit
SW1(config)#vlan fil
SW1(config)#vlan filter V-MAP vlan-list 128
SW1(config)#no vlan filter V-MAP vlan-list 128
SW1(config)#vlan filter V-MAP vlan-list 128
SW1(config)#vlan acc
SW1(config)#vlan access-ma
SW1(config)#vlan access-map V-MAP ?
<0-65535> Sequence to insert to/delete from existing vlan access-map entry
<cr>
SW1(config)#vlan access-map V-MAP 20
SW1(config-access-map)#no permit host 001b.2a77.66d2 any
^
% Invalid input detected at '^' marker.
SW1(config-access-map)#no permit host 001b.2a77.66
SW1(config-access-map)#exit
SW1(config)#int mac-acc
SW1(config)#int mac-acce
SW1(config)#mac add
SW1(config)#mac acc
SW1(config)#mac access-list exte
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#per
SW1(config-ext-macl)#permit ho
SW1(config-ext-macl)#no permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#ac
SW1(config-ext-macl)#acti
SW1(config-ext-macl)#actio
SW1(config-ext-macl)#action for
SW1(config-ext-macl)#permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#no permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#deny host 001b.2a77.66d2 any
SW1(config-ext-macl)#no deny host 001b.2a77.66d2 any
SW1(config-ext-macl)#permit any host 0024.c431.126e
SW1(config-ext-macl)#permit host 001b.2a77.66d2 host 0024.c431.126e
SW1(config-ext-macl)#deny host 001b.2a77.66d2 host 0024.c431.126e
SW1(config-ext-macl)#no deny host 001b.2a77.66d2 host 0024.c431.126e
SW1(config-ext-macl)#permit host 001b.2a77.66d2 host 0024.c431.126e
SW1(config-ext-macl)#no permit host 001b.2a77.66d2 host 0024.c431.126e
SW1(config-ext-macl)#permi
SW1(config-ext-macl)#permit host 001b.2a77.66 an
SW1(config-ext-macl)#permit host 001b.2a77.66 any
SW1(config-ext-macl)#^Z
SW1#sh a
*Mar 1 00:19:53.749: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh acc
SW1#sh access-li
SW1#sh access-lists
Extended IP access list 101
10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV
permit any host 0024.c431.126e
permit host 001b.2a77.0066 any
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#no permit any host 0024.c431.126e
SW1(config-ext-macl)#do sh access-list
Extended IP access list 101
10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV
permit host 001b.2a77.0066 any
SW1(config-ext-macl)#
*Mar 1 00:21:05.446: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/1, changed state to down
*Mar 1 00:21:06.453: %LINK-3-UPDOWN: Interface FastEthernet1/0/1, changed state to down
SW1(config-ext-macl)#
*Mar 1 00:21:10.957: %LINK-3-UPDOWN: Interface FastEthernet1/0/1, changed state to up
*Mar 1 00:21:11.964: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/1, changed state to up
SW1(config-ext-macl)#^Z
SW1#do
*Mar 1 00:21:31.736: %SYS-5-CONFIG_I: Configured from console by console
SW1#do debu
SW1#debu
SW1#debug vla
SW1#debug vlan acce
SW1#sh vlan acce
SW1#sh vlan access-m
SW1#sh vlan access-map
Vlan access-map "V-MAP" 10
Match clauses:
ip address: 101
Action:
drop
Vlan access-map "V-MAP" 20
Match clauses:
mac address: DBSV
Action:
drop
Vlan access-map "V-MAP" 30
Match clauses:
Action:
forward
SW1#sh vlan filter\
^
% Invalid input detected at '^' marker.
SW1#sh vlan filter
VLAN Map V-MAP is filtering VLANs:
128
SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#mac access-list extended DEVIL
SW1(config-ext-macl)# permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#exit
SW1(config)#vlan access-map V-MAP 25
SW1(config-access-map)#ma
SW1(config-access-map)#match ma
SW1(config-access-map)#match mac add
SW1(config-access-map)#match mac address DEVIL
SW1(config-access-map)#ac
SW1(config-access-map)#action dr
SW1(config-access-map)#action drop
SW1(config-access-map)#^Z
SW1#
*Mar 1 00:24:59.975: %SYS-5-CONFIG_I: Configured from console by console
SW1#
References
tech/network/cisco/acl/vacl/vacl.txt · Last modified: 2019/09/07 15:32 by wnoguchi
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
