Cisco VACL

VACL, VLAN, ACL, Security, Cisco, Networking

Blueprint

CCIE R&S
- Written v5.1
  - 5.0 Infrastructure Security
    - 5.2 Network security
      - 5.2.a [i] VACL, PACL
- Lab v5.0
  - 5.0 Infrastructure Security
    - 5.2 Network security
      - 4.2.a [i] VACL, PACL

Physical Lab

Base Configuration

SW1

configure terminal
!
vtp mode transparent
!
vlan 128-130
exit
!
ip routing
!
spanning-tree portfast default
!
interface Vlan 128
 ip address 10.0.128.1 255.255.255.0
 no shutdown
exit
interface Vlan 129
 ip address 10.0.129.1 255.255.255.0
 no shutdown
exit
interface Vlan 130
 ip address 10.0.130.1 255.255.255.0
 no shutdown
exit
interface FastEthernet 1/0/1
 switchport mode access
 switchport access vlan 128
exit
interface FastEthernet 1/0/2
 switchport mode access
 switchport access vlan 130
exit
interface FastEthernet 1/0/4
 switchport mode access
 switchport access vlan 129
exit
interface FastEthernet 1/0/5
 switchport mode access
 switchport access vlan 128
exit
!
end

R1

configure terminal
!
interface FastEthernet 0/0
 ip address 10.0.128.101 255.255.255.0
 no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 10.0.128.1
!
line vty 0 15
 privilege level 15
 password kotone
 login
exit
!
end

R2

configure terminal
!
interface FastEthernet 0/0
 ip address 10.0.130.102 255.255.255.0
 no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 10.0.130.1
!
line vty 0 15
 privilege level 15
 password kotone
 login
exit
!
end

VACL Configuration

SW1

configure terminal
!
access-list 101 permit ip 10.0.129.0 0.0.0.255 any
!
mac access-list extended DBSV
 permit host 001b.2a77.66d2 any
exit
!
vlan access-map V-MAP 10
 match ip address 101
 action drop
exit
vlan access-map V-MAP 20
 match mac address DBSV
 action drop
exit
vlan access-map V-MAP 30
 action forward
exit
!
vlan filter V-MAP vlan-list 128
!
end

vlan filter V-MAP vlan-list 128, 130

Verification

SW1 Console Log

SW1>enable
SW1#
*Mar  1 00:17:23.668: %LINK-3-UPDOWN: Interface FastEthernet1/0/1, changed state to up
*Mar  1 00:17:24.675: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/1, changed state to up
SW1#
*Mar  1 00:17:42.668: %LINK-3-UPDOWN: Interface FastEthernet1/0/2, changed state to up
*Mar  1 00:17:43.675: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/2, changed state to up
SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#do sh vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa1/0/1, Fa1/0/2, Fa1/0/3
                                                Fa1/0/4, Fa1/0/5, Fa1/0/6
                                                Fa1/0/7, Fa1/0/8, Fa1/0/9
                                                Fa1/0/10, Fa1/0/11, Fa1/0/12
                                                Fa1/0/13, Fa1/0/14, Fa1/0/15
                                                Fa1/0/16, Fa1/0/17, Fa1/0/18
                                                Fa1/0/19, Fa1/0/20, Fa1/0/21
                                                Fa1/0/22, Fa1/0/23, Fa1/0/24
                                                Gi1/0/1, Gi1/0/2
128  VLAN0128                         active    
129  VLAN0129                         active    
1002 fddi-default                     act/unsup 
1003 token-ring-default               act/unsup 
1004 fddinet-default                  act/unsup 
1005 trnet-default                    act/unsup 

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0   
128  enet  100128     1500  -      -      -        -    -        0      0   
          
SW1(config)#vt
SW1(config)#vtp mo
SW1(config)#vtp mode tra
SW1(config)#vtp mode transparent 
Device mode already VTP Transparent for VLANS.
SW1(config)#vla
SW1(config)#vlan 128-130
SW1(config-vlan)#exit
SW1(config)#ip rou
SW1(config)#ip routi
SW1(config)#ip routing 
SW1(config)#spa
SW1(config)#spanning-tree po
SW1(config)#spanning-tree portfast defa
SW1(config)#spanning-tree portfast default 
%Warning: this command enables portfast by default on all interfaces. You
 should now disable portfast explicitly on switched ports leading to hubs,
 switches and bridges as they may create temporary bridging loops.

SW1(config)#int vlan 128
SW1(config-if)#ip add
SW1(config-if)#ip address 
*Mar  1 00:41:38.286: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan128, changed state to down
SW1(config-if)#ip address 10.0.128.1 255.255.255.0
SW1(config-if)#int vlan 129
SW1(config-if)#ip add 
*Mar  1 00:46:59.973: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan129, changed state to down
SW1(config-if)#ip add 10.0.129.1 255.255.255.0
SW1(config-if)#no shut
SW1(config-if)#int vlan 128
SW1(config-if)#no shut
SW1(config-if)#int vlan 130
SW1(config-if)#
*Mar  1 00:47:25.466: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to down
SW1(config-if)#ip addre 10.0.130.1 255.255.255.0
SW1(config-if)#no shut
SW1(config-if)#int f1/0/1
SW1(config-if)#swi
SW1(config-if)#switchport mo
SW1(config-if)#switchport mode a
SW1(config-if)#switchport mode access 
SW1(config-if)#int range f1/0/5
SW1(config-if-range)#swi
SW1(config-if-range)#switchport mo
SW1(config-if-range)#int range f1/0/1-5     
SW1(config-if-range)#swi
SW1(config-if-range)#switchport mo
SW1(config-if-range)#switchport mode ac
SW1(config-if-range)#switchport mode access 
SW1(config-if-range)#exit
SW1(config)#int f1/0/1
SW1(config-if)#swi
SW1(config-if)#switchport mo
SW1(config-if)#switchport mode ac
SW1(config-if)#switchport mode access vla
SW1(config-if)#switchport mode access vlan
SW1(config-if)#switchport ac              
SW1(config-if)#switchport access vl
SW1(config-if)#switchport access vlan 128
SW1(config-if)#int
*Mar  1 00:48:57.833: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan128, changed state to up
SW1(config-if)#int f1/0/5
SW1(config-if)#sw
SW1(config-if)#switchport mo
SW1(config-if)#switchport mode ac
SW1(config-if)#switchport mode access vl
SW1(config-if)#switchport ac            
SW1(config-if)#switchport access vla
SW1(config-if)#switchport access vlan 128
SW1(config-if)#int f1/0/2
SW1(config-if)#sw
SW1(config-if)#switchport mo
SW1(config-if)#switchport mode ac
SW1(config-if)#switchport ac          
SW1(config-if)#switchport access vl
SW1(config-if)#switchport access vlan 130
SW1(config-if)#
*Mar  1 00:49:44.582: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to up
SW1(config-if)#int f1/0/4
SW1(config-if)#sw
SW1(config-if)#switchport ac
SW1(config-if)#switchport access vla
SW1(config-if)#switchport access vlan 129
SW1(config-if)#
*Mar  1 00:50:05.462: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan129, changed state to up
SW1(config-if)#^Z
SW1#
*Mar  1 00:50:09.463: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh ip ro
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C        10.0.128.0/24 is directly connected, Vlan128
L        10.0.128.1/32 is directly connected, Vlan128
C        10.0.129.0/24 is directly connected, Vlan129
L        10.0.129.1/32 is directly connected, Vlan129
C        10.0.130.0/24 is directly connected, Vlan130
L        10.0.130.1/32 is directly connected, Vlan130
SW1#sh clock\
            ^
% Invalid input detected at '^' marker.

SW1#sh clock
*00:51:06.807 UTC Mon Mar 1 1993
SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#ntp ma
SW1(config)#ntp ser
SW1(config)#ntp server 10.0.128.254
SW1(config)#ntp up
SW1(config)#ntp upda
SW1(config)#ntp up? 
% Unrecognized command
SW1(config)#^Z    
SW1#sh dcl
*Mar  1 00:51:31.076: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh clock
*22:00:43.979 UTC Tue Aug 27 2019
SW1#sh sta
SW1#sh clock detai
22:00:54.632 UTC Tue Aug 27 2019
Time source is NTP
SW1#sh stat
SW1#sh ntp status
Clock is synchronized, stratum 3, reference is 10.0.128.254  
nominal freq is 119.2092 Hz, actual freq is 119.2092 Hz, precision is 2**17
reference time is E1102696.88CE02B0 (22:00:54.534 UTC Tue Aug 27 2019)
clock offset is 0.5069 msec, root delay is 8.79 msec
root dispersion is 7939.38 msec, peer dispersion is 7937.50 msec
loopfilter state is 'CTRL' (Normal Controlled Loop), drift is 0.000000001 s/s
system poll interval is 64, last update was 18 sec ago.
SW1#sh clock
22:01:16.921 UTC Tue Aug 27 2019
SW1#sh clock
22:01:18.590 UTC Tue Aug 27 2019
SW1#sh clock
22:01:19.748 UTC Tue Aug 27 2019
SW1#sh clock
22:01:20.645 UTC Tue Aug 27 2019
SW1#sh clock
22:01:21.342 UTC Tue Aug 27 2019
SW1#sh clock
22:01:21.979 UTC Tue Aug 27 2019
SW1#sh clock
22:01:22.701 UTC Tue Aug 27 2019
SW1#sh clock
22:01:24.538 UTC Tue Aug 27 2019
SW1#sh clock
22:01:25.628 UTC Tue Aug 27 2019
SW1#sh clock
22:01:26.484 UTC Tue Aug 27 2019
SW1#sh clock
22:01:27.189 UTC Tue Aug 27 2019
SW1#sh clock
22:01:28.220 UTC Tue Aug 27 2019
SW1#sh clock
22:01:28.866 UTC Tue Aug 27 2019
SW1#sh clock
22:01:29.487 UTC Tue Aug 27 2019
SW1#sh clock
22:01:30.167 UTC Tue Aug 27 2019
SW1#sh clock
22:01:30.821 UTC Tue Aug 27 2019
SW1#sh clcok
         ^
% Invalid input detected at '^' marker.

SW1#sh clock\
            ^
% Invalid input detected at '^' marker.

SW1#sh clock 
22:04:37.979 UTC Tue Aug 27 2019
SW1#?
Exec commands:
  access-enable    Create a temporary Access-List entry
  access-profile   Apply user-profile to interface
  access-template  Create a temporary Access-List entry
  archive          manage archive files
  beep             Blocks Extensible Exchange Protocol commands
  call-home        Call-Home commands
  cd               Change current directory
  clear            Reset functions
  clock            Manage the system clock
  cns              CNS agents
  configure        Enter configuration mode
  connect          Open a terminal connection
  copy             Copy from one file to another
  crypto           Encryption related commands.
  cts              Cisco Trusted Security Exec Commands
  debug            Debugging functions (see also 'undebug')
  delete           Delete a file
  diagnostic       Diagnostic commands
  dir              List files on a filesystem
  disable          Turn off privileged commands
  disconnect       Disconnect an existing network connection
Press RETURN for another line, SPACE for another page, anything else to quit
          
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#
SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#acc
SW1(config)#access-li
SW1(config)#access-list 101 permi
SW1(config)#access-list 101 permit ip 10.0.129.0 0.0.0.255 an
SW1(config)#access-list 101 permit ip 10.0.129.0 0.0.0.255 any 
SW1(config)#ma
SW1(config)#mac acc
SW1(config)#mac access-list exte
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#permi
SW1(config-ext-macl)#permit ho
SW1(config-ext-macl)#permit host ?
  H.H.H  48-bit source MAC address

SW1(config-ext-macl)#permit host 001b.2a77.66d2 an
SW1(config-ext-macl)#permit host 001b.2a77.66d2 any 
SW1(config-ext-macl)#exit
SW1(config)#vlan acce
SW1(config)#vlan access-m
SW1(config)#vlan access-map V-MAP 10
SW1(config-access-map)#ma
SW1(config-access-map)#match ip
SW1(config-access-map)#match ip add
SW1(config-access-map)#match ip address 101
SW1(config-access-map)#ac
SW1(config-access-map)#action dr
SW1(config-access-map)#action drop 
SW1(config-access-map)#vlan access-ma V-MAP 20
SW1(config-access-map)#mat
SW1(config-access-map)#match ma
SW1(config-access-map)#match mac add
SW1(config-access-map)#match mac address DBSV
SW1(config-access-map)#ac
SW1(config-access-map)#action dr
SW1(config-access-map)#action drop 
SW1(config-access-map)#exit
SW1(config)#vlan acc
SW1(config)#vlan access-ma
SW1(config)#vlan access-map V-MAP 30
SW1(config-access-map)#actio
SW1(config-access-map)#action for
SW1(config-access-map)#action forward 
SW1(config-access-map)#exit
SW1(config)#vla
SW1(config)#vlan fil
SW1(config)#vlan filter V-MAP vla
SW1(config)#vlan filter V-MAP vlan-list ?
  <1-4094>  VLAN id
  all       Add this filter to all VLANs

SW1(config)#vlan filter V-MAP vlan-list 128 ?
  ,  comma
  -  hyphen
  <cr>

SW1(config)#vlan filter V-MAP vlan-list 128  
SW1(config)#no vlan filter V-MAP vlan-list 128
SW1(config)#vlan filter V-MAP vlan-list 128   
SW1(config)#no vlan filter V-MAP vlan-list 128
SW1(config)#vlan filter V-MAP vlan-list 128   
SW1(config)#^Z
SW1#sh 
Aug 27 22:16:06.224: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh vlan acc
SW1#sh vlan access-m
SW1#sh vlan access-map 
Vlan access-map "V-MAP"  10
  Match clauses:
    ip  address: 101
  Action:
    drop
Vlan access-map "V-MAP"  20
  Match clauses:
    mac address: DBSV
  Action:
    drop
Vlan access-map "V-MAP"  30
  Match clauses:
  Action:
    forward
SW1#sh vlan filter
VLAN Map V-MAP is filtering VLANs:
  128
SW1#sh acc
SW1#sh access-li
SW1#sh access-lists 
Extended IP access list 101
    10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV 
    permit host 001b.2a77.66d2 any
SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#swi
SW1(config)#switch ac
SW1(config)#switch ace
SW1(config)#switch acce
SW1(config)#vl         
SW1(config)#vlan fi
SW1(config)#vlan filter V-MAP vlan
SW1(config)#vlan filter V-MAP vlan-list 128,130
SW1(config)#do sh run vlan filter
Building configuration...

Command rejected: Bad VLAN list - character #1 is a non-numeric
character ('f').
Current configuration:
end

SW1(config)#do sh run | vlan filter
                        ^
% Invalid input detected at '^' marker.

SW1(config)#do sh run | i vlan filter
vlan filter V-MAP vlan-list 128,130
SW1(config)#manc acc                 
SW1(config)#manc acce
SW1(config)#manc access
SW1(config)#mac acce   
SW1(config)#mac access-list ex
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#pe
SW1(config-ext-macl)#permit an
SW1(config-ext-macl)#permit any ho
SW1(config-ext-macl)#permit any host 0024.c431.126e
SW1(config-ext-macl)#^Z 
SW1#sh 
Aug 27 22:30:17.504: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh vlan access-map
Vlan access-map "V-MAP"  10
  Match clauses:
    ip  address: 101
  Action:
    drop
Vlan access-map "V-MAP"  20
  Match clauses:
    mac address: DBSV
  Action:
    drop
Vlan access-map "V-MAP"  30
  Match clauses:
  Action:
    forward
SW1#sh acce
SW1#sh access-li
SW1#sh access-lists 
Extended IP access list 101
    10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV 
    permit host 001b.2a77.66d2 any
    permit any host 0024.c431.126e
SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#int f1/0/2
SW1(config-if)#swi
SW1(config-if)#switchport mo
SW1(config-if)#switchport a    
SW1(config-if)#switchport ac
SW1(config-if)#switchport access vl
SW1(config-if)#switchport access vlan 128
SW1(config-if)#
Aug 27 22:32:47.586: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to down
SW1(config-if)#exit
SW1(config)#swi
SW1(config)#mac    
SW1(config)#mac add
SW1(config)#mac acc           
SW1(config)#mac access-list ex
SW1(config)#mac access-list ?        
  extended  Extended Access List

SW1(config)#mac access-list ex
SW1(config)#mac access-list extended ?
  WORD  access-list name

SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#no permit any host 0024.c431.126e
SW1(config-ext-macl)#do sh access-lists
Extended IP access list 101
    10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV 
    permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#no per                           
SW1(config-ext-macl)#no permit ho
SW1(config-ext-macl)#exit           
SW1(config)#ma
SW1(config)#vlan acc
SW1(config)#vlan access-?
WORD  access-log  access-map  

SW1(config)#vlan access-ma
SW1(config)#vlan access-map V-MAP 20
SW1(config-access-map)#ac
SW1(config-access-map)#action for
SW1(config-access-map)#action forward 
SW1(config-access-map)#action drop    
SW1(config-access-map)#exit                    
SW1(config)#vlan acce
SW1(config)#vlan access-ma
SW1(config)#mac acc                 
SW1(config)#mac access-list ex
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#permi
SW1(config-ext-macl)#permit ho
SW1(config-ext-macl)#permit an   
SW1(config-ext-macl)#permit any  ho
SW1(config-ext-macl)#no permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#vlan access-map V-MAP 20
SW1(config-access-map)#ac
SW1(config-access-map)#action for
SW1(config-access-map)#action forward 
SW1(config-access-map)#action drop    
SW1(config-access-map)#mac access-list extended DBSV
SW1(config-ext-macl)#den
SW1(config-ext-macl)#deny an
SW1(config-ext-macl)#deny any an
SW1(config-ext-macl)#permi        
SW1(config-ext-macl)#permit an
SW1(config-ext-macl)#permit any an
SW1(config-ext-macl)#permit any any 
SW1(config-ext-macl)#no permit any any 
SW1(config-ext-macl)#per
SW1(config-ext-macl)#permit any host 0024.c431.126e
SW1(config-ext-macl)#exit
SW1(config)#do sh vlan bri

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa1/0/3, Fa1/0/6, Fa1/0/7
                                                Fa1/0/8, Fa1/0/9, Fa1/0/10
                                                Fa1/0/11, Fa1/0/12, Fa1/0/13
                                                Fa1/0/14, Fa1/0/15, Fa1/0/16
                                                Fa1/0/17, Fa1/0/18, Fa1/0/19
                                                Fa1/0/20, Fa1/0/21, Fa1/0/22
                                                Fa1/0/23, Fa1/0/24, Gi1/0/1
                                                Gi1/0/2
128  VLAN0128                         active    Fa1/0/1, Fa1/0/2, Fa1/0/5
129  VLAN0129                         active    Fa1/0/4
130  VLAN0130                         active    
1002 fddi-default                     act/unsup 
1003 token-ring-default               act/unsup 
1004 fddinet-default                  act/unsup 
1005 trnet-default                    act/unsup 
SW1(config)#do vlan filter
                ^
% Invalid input detected at '^' marker.

SW1(config)#do sh vlan filter
VLAN Map V-MAP is filtering VLANs:
  128,130
SW1(config)#do sh access-lists
Extended IP access list 101
    10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV 
    permit any host 0024.c431.126e
SW1(config)#sh ac
SW1(config)#do sh acc 
SW1(config)#do sh access-li
SW1(config)#do sh access-lists ?
  <1-2799>    ACL number
  WORD        ACL name
  hardware    Show access-list hardware info
  ipc         Show access-list config download info
  rate-limit  Show rate-limit access lists
  |           Output modifiers
  <cr>

SW1(config)#do sh vlan acc     
SW1(config)#do sh vlan access-ma
SW1(config)#do sh vlan access-map 
Vlan access-map "V-MAP"  10
  Match clauses:
    ip  address: 101
  Action:
    drop
Vlan access-map "V-MAP"  20
  Match clauses:
    mac address: DBSV
  Action:
    drop
Vlan access-map "V-MAP"  30
  Match clauses:
  Action:
    forward
SW1(config)#vlan fi 
SW1(config)#vlan filter V-MAP vla
SW1(config)#vlan filter V-MAP vlan-list 128
SW1(config)#no vlan filter V-MAP vlan-list 128
SW1(config)#vlan filter V-MAP vlan-list 128   
SW1(config)#^Z
SW1#sh 
Aug 27 22:42:41.721: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh acce
SW1#sh access-li
SW1#sh access-lists 
Extended IP access list 101
    10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV 
    permit any host 0024.c431.126e
SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#int f1/0/1
SW1(config-if)#exit
SW1(config)#ma
SW1(config)#mac acc
SW1(config)#mac access-list ex
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#per
SW1(config-ext-macl)#permit ho
SW1(config-ext-macl)#permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#action forward
                     ^
% Invalid input detected at '^' marker.

SW1(config-ext-macl)#vlan access-map V-MAP 20
SW1(config-access-map)#mat
SW1(config-access-map)#match ma
SW1(config-access-map)#match mac add
SW1(config-access-map)#match mac address DBSS
SW1(config-access-map)#match mac address DBSV
SW1(config-access-map)#acti                  
SW1(config-access-map)#action dr
SW1(config-access-map)#action drop 
SW1(config-access-map)#do sh vlan-acc
SW1(config-access-map)#do sh vlan-access map
                                 ^
% Invalid input detected at '^' marker.

SW1(config-access-map)#do sh vlan access-map
Vlan access-map "V-MAP"  10
  Match clauses:
    ip  address: 101
  Action:
    drop
Vlan access-map "V-MAP"  20
  Match clauses:
    mac address: DBSV DBSS
  Action:
    drop
Vlan access-map "V-MAP"  30
  Match clauses:
  Action:
    forward
SW1(config-access-map)#no match mac address DBSV
% Ambiguous command:  "no match mac address DBSV"
SW1(config-access-map)#no match mac address     
SW1(config-access-map)#match mac address DBSV
SW1(config-access-map)#do sh vlan access-map    
Vlan access-map "V-MAP"  10
  Match clauses:
    ip  address: 101
  Action:
    drop
Vlan access-map "V-MAP"  20
  Match clauses:
    mac address: DBSV
  Action:
    drop
Vlan access-map "V-MAP"  30
  Match clauses:
  Action:
    forward
SW1(config-access-map)#^Z
SW1#reload
Aug 27 22:48:26.310: %SYS-5-CONFIG_I: Configured from console by console
SW1#reload

System configuration has been modified. Save? [yes/no]: no
Proceed with reload? [confirm]

Aug 27 22:48:31.906: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload command.

(snip)

SW1>
SW1>
SW1>
*Mar  1 00:01:48.993: %PKI-6-AUTOSAVE: Running configuration saved to NVRAM
SW1>[OK]en
SW1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#!
SW1(config)#vtp mode transparent
Device mode already VTP Transparent for VLANS.
SW1(config)#!
SW1(config)#vlan 128-130
SW1(config-vlan)#exit
SW1(config)#!
SW1(config)#ip routing
SW1(config)#!
SW1(config)#spanning-tree portfast default
%Warning: this command enables portfast by default on all interfaces. You
 should now disable portfast explicitly on switched ports leading to hubs,
 switches and bridges as they may create temporary bridging loops.

SW1(config)#!
SW1(config)#interface Vlan 128
SW1(config-if)# ip address 10.0.128.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)#exit
SW1(config)#interface Vlan 129
SW1(config-if)# ip address 10.0.129.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)#exit
SW1(config)#interface Vlan 130
SW1(config-if)# ip address 10.0.130.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)#exit
SW1(config)#interface FastEthernet 1/0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 128
SW1(config-if)#exit
SW1(config)#interface FastEthernet 1/0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 130
SW1(config-if)#exit
SW1(config)#interface FastEthernet 1/0/4
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 129
SW1(config-if)#exit
SW1(config)#interface FastEthernet 1/0/5
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 128
SW1(config-if)#exit
SW1(config)#!
SW1(config)#end
SW1#
*Mar  1 00:02:25.533: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan128, changed state to down
*Mar  1 00:02:26.171: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan129, changed state to down
*Mar  1 00:02:26.205: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to down
*Mar  1 00:02:26.288: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan128, changed state to up
SW1#  1 00:02:26.347: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to up
*Mar  1 00:02:26.448: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan129, changed state to up
SW1#
*Mar  1 00:02:27.094: %SYS-5-CONFIG_I: Configured from console by console
SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#acc
SW1(config)#access-li
SW1(config)#int f1/0/2  
SW1(config-if)#swi
SW1(config-if)#switchport mo
SW1(config-if)#switchport ac    
SW1(config-if)#switchport access vl
SW1(config-if)#switchport access vlan 128
SW1(config-if)#
*Mar  1 00:03:08.458: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan130, changed state to down
SW1(config-if)#exit
SW1(config)#acc
SW1(config)#access-li
SW1(config)#access-list 101 per
SW1(config)#access-list 101 permit ip 10.0.129.0 0.0.0.255 an
SW1(config)#access-list 101 permit ip 10.0.129.0 0.0.0.255 any 
SW1(config)#ma
SW1(config)#mac acc
SW1(config)#mac access-list exte
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#permi
SW1(config-ext-macl)#permit ho
SW1(config-ext-macl)#permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#exit
SW1(config)#vlan acce
SW1(config)#vlan access-ma
SW1(config)#vlan access-map V-MAP 10
SW1(config-access-map)#mat
SW1(config-access-map)#match ip
SW1(config-access-map)#match ip add
SW1(config-access-map)#match ip address 101
SW1(config-access-map)#ac
SW1(config-access-map)#action dr
SW1(config-access-map)#action drop 
SW1(config-access-map)#vlan access-map V-MAP 20
SW1(config-access-map)#mat
SW1(config-access-map)#match ma
SW1(config-access-map)#match mac add
SW1(config-access-map)#match mac address DBSV 
SW1(config-access-map)#ac
SW1(config-access-map)#action dro
SW1(config-access-map)#action drop 
SW1(config-access-map)#vlan access-map V-MAP 30
SW1(config-access-map)#actio
SW1(config-access-map)#action for
SW1(config-access-map)#action forward 
SW1(config-access-map)#exit
SW1(config)#vlan fil
SW1(config)#vlan filter V-MAP vlan-list 128
SW1(config)#no vlan filter V-MAP vlan-list 128
SW1(config)#vlan filter V-MAP vlan-list 128   
SW1(config)#vlan acc                       
SW1(config)#vlan access-ma
SW1(config)#vlan access-map V-MAP ?
  <0-65535>  Sequence to insert to/delete from existing vlan access-map entry
  <cr>

SW1(config)#vlan access-map V-MAP 20
SW1(config-access-map)#no permit host 001b.2a77.66d2 any
                          ^
% Invalid input detected at '^' marker.

SW1(config-access-map)#no permit host 001b.2a77.66      
SW1(config-access-map)#exit                       
SW1(config)#int mac-acc
SW1(config)#int mac-acce
SW1(config)#mac add     
SW1(config)#mac acc           
SW1(config)#mac access-list exte
SW1(config)#mac access-list extended DBSV
SW1(config-ext-macl)#per
SW1(config-ext-macl)#permit ho
SW1(config-ext-macl)#no permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#ac                               
SW1(config-ext-macl)#acti
SW1(config-ext-macl)#actio
SW1(config-ext-macl)#action for
SW1(config-ext-macl)#permit host 001b.2a77.66d2 any   
SW1(config-ext-macl)#no permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#deny host 001b.2a77.66d2 any     
SW1(config-ext-macl)#no deny host 001b.2a77.66d2 any
SW1(config-ext-macl)#permit any host 0024.c431.126e
SW1(config-ext-macl)#permit host 001b.2a77.66d2 host 0024.c431.126e
SW1(config-ext-macl)#deny host 001b.2a77.66d2 host 0024.c431.126e   
SW1(config-ext-macl)#no deny host 001b.2a77.66d2 host 0024.c431.126e
SW1(config-ext-macl)#permit host 001b.2a77.66d2 host 0024.c431.126e 
SW1(config-ext-macl)#no permit host 001b.2a77.66d2 host 0024.c431.126e
SW1(config-ext-macl)#permi                                            
SW1(config-ext-macl)#permit host 001b.2a77.66 an
SW1(config-ext-macl)#permit host 001b.2a77.66 any 
SW1(config-ext-macl)#^Z
SW1#sh a
*Mar  1 00:19:53.749: %SYS-5-CONFIG_I: Configured from console by console
SW1#sh acc
SW1#sh access-li
SW1#sh access-lists 
Extended IP access list 101
    10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV 
    permit any host 0024.c431.126e
    permit host 001b.2a77.0066 any
SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#mac access-list extended DBSV                    
SW1(config-ext-macl)#no permit any host 0024.c431.126e
SW1(config-ext-macl)#do sh access-list                                
Extended IP access list 101
    10 permit ip 10.0.129.0 0.0.0.255 any
Extended MAC access list DBSV 
    permit host 001b.2a77.0066 any
SW1(config-ext-macl)#
*Mar  1 00:21:05.446: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/1, changed state to down
*Mar  1 00:21:06.453: %LINK-3-UPDOWN: Interface FastEthernet1/0/1, changed state to down
SW1(config-ext-macl)#
*Mar  1 00:21:10.957: %LINK-3-UPDOWN: Interface FastEthernet1/0/1, changed state to up
*Mar  1 00:21:11.964: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0/1, changed state to up
SW1(config-ext-macl)#^Z
SW1#do
*Mar  1 00:21:31.736: %SYS-5-CONFIG_I: Configured from console by console
SW1#do debu
SW1#debu   
SW1#debug vla
SW1#debug vlan acce
SW1#sh vlan acce          
SW1#sh vlan access-m
SW1#sh vlan access-map 
Vlan access-map "V-MAP"  10
  Match clauses:
    ip  address: 101
  Action:
    drop
Vlan access-map "V-MAP"  20
  Match clauses:
    mac address: DBSV
  Action:
    drop
Vlan access-map "V-MAP"  30
  Match clauses:
  Action:
    forward
SW1#sh vlan filter\
                  ^
% Invalid input detected at '^' marker.

SW1#sh vlan filter 
VLAN Map V-MAP is filtering VLANs:
  128
SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#mac access-list extended DEVIL
SW1(config-ext-macl)# permit host 001b.2a77.66d2 any
SW1(config-ext-macl)#exit
SW1(config)#vlan access-map V-MAP 25
SW1(config-access-map)#ma
SW1(config-access-map)#match ma
SW1(config-access-map)#match mac add
SW1(config-access-map)#match mac address DEVIL
SW1(config-access-map)#ac
SW1(config-access-map)#action dr
SW1(config-access-map)#action drop 
SW1(config-access-map)#^Z
SW1#
*Mar  1 00:24:59.975: %SYS-5-CONFIG_I: Configured from console by console
SW1#

References

PG1X WIKI

Table of Contents

Cisco VACL

Blueprint

Physical Lab

Base Configuration

VACL Configuration

Verification

References

PG1X WIKI

User Tools

Site Tools

Table of Contents

Cisco VACL

Blueprint

Physical Lab

Base Configuration

VACL Configuration

Verification

References

Page Tools