Home » Cisco Manuals » Wireless » Cisco 3750G » Manual Viewer

Cisco 3750G Configuration Guide - Page 706

Using VLAN Maps with Router ACLs

UPC - 882658121319

Add to My Manuals
Save this manual to your list of manuals

Page 706 highlights

Using VLAN Maps with Router ACLs Chapter 32 Configuring Network Security with ACLs Figure 32-5 Deny Access to a Server on Another a VLAN VLAN map 10.1.1.100 Server (VLAN 10) Subnet 10.1.2.0/8 10.1.1.4 Host (VLAN 10) 10.1.1.8 Host (VLAN 10) Layer 3 switch Host (VLAN 20) Packet 101356 This example shows how to deny access to a server on another VLAN by creating the VLAN map SERVER 1 that denies access to hosts in subnet 10.1.2.0.8, host 10.1.1.4, and host 10.1.1.8 and permits other IP traffic. The final step is to apply the map SERVER1 to VLAN 10. Step 1 Step 2 Step 3 Define the IP ACL that will match the correct packets. Switch(config)# ip access-list extended SERVER1_ACL Switch(config-ext-nacl))# permit ip 10.1.2.0 0.0.0.255 host 10.1.1.100 Switch(config-ext-nacl))# permit ip host 10.1.1.4 host 10.1.1.100 Switch(config-ext-nacl))# permit ip host 10.1.1.8 host 10.1.1.100 Switch(config-ext-nacl))# exit Define a VLAN map using this ACL that will drop IP packets that match SERVER1_ACL and forward IP packets that do not match the ACL. Switch(config)# vlan access-map SERVER1_MAP Switch(config-access-map)# match ip address SERVER1_ACL Switch(config-access-map)# action drop Switch(config)# vlan access-map SERVER1_MAP 20 Switch(config-access-map)# action forward Switch(config-access-map)# exit Apply the VLAN map to VLAN 10. Switch(config)# vlan filter SERVER1_MAP vlan-list 10. Using VLAN Maps with Router ACLs To access control both bridged and routed traffic, you can use VLAN maps only or a combination of router ACLs and VLAN maps. You can define router ACLs on both input and output routed VLAN interfaces, and you can define a VLAN map to access control the bridged traffic. If a packet flow matches a VLAN-map deny clause in the ACL, regardless of the router ACL configuration, the packet flow is denied. 32-36 Catalyst 3750 Switch Software Configuration Guide OL-8550-02

Section	Page
Catalyst 3750 SwitchSoftware Configuration Guide	1
Contents	3
Preface	43
Audience	43
Purpose	43
Conventions	44
Related Publications	44
Obtaining Documentation	46
Cisco.com	46
Product Documentation DVD	46
Ordering Documentation	46
Documentation Feedback	47
Cisco Product Security Overview	47
Reporting Security Problems in Cisco Products	47
Product Alerts and Field Notices	48
Obtaining Technical Assistance	48
Cisco Support Website	48
Submitting a Service Request	49
Definitions of Service Request Severity	49
Obtaining Additional Publications and Information	50
Overview	53
Features	53
Ease-of-Deployment and Ease-of-Use Features	54
Performance Features	56
Management Options	57
Manageability Features	57
Availability and Redundancy Features	58
VLAN Features	59
Security Features	60
QoS and CoS Features	61
Layer3 Features	63
Power over Ethernet Features	64
Monitoring Features	64
Default Settings After Initial Switch Configuration	64
Network Configuration Examples	67
Design Concepts for Using the Switch	68
Small to Medium-Sized Network Using Catalyst 3750 Switches	73
Large Network Using Catalyst 3750 Switches	75
Multidwelling Network Using Catalyst 3750 Switches	77
Long-Distance, High-Bandwidth Transport Configuration	78
Where to Go Next	79
Using the Command-Line Interface	81
Understanding Command Modes	81
Understanding the Help System	83
Understanding Abbreviated Commands	84
Understanding no and default Forms of Commands	84
Understanding CLI Error Messages	85
Using Configuration Logging	85
Using Command History	86
Changing the Command History Buffer Size	86
Recalling Commands	86
Disabling the Command History Feature	87
Using Editing Features	87
Enabling and Disabling Editing Features	87
Editing Commands through Keystrokes	87
Editing Command Lines that Wrap	89
Searching and Filtering Output of show and more Commands	90
Accessing the CLI	90
Accessing the CLI through a Console Connection or through Telnet	90
Assigning the Switch IP Address and Default Gateway	93
Understanding the Boot Process	93
Assigning Switch Information	94
Default Switch Information	95
Understanding DHCP-Based Autoconfiguration	95
DHCP Client Request Process	96
Configuring DHCP-Based Autoconfiguration	97
DHCP Server Configuration Guidelines	97
Configuring the TFTP Server	98
Configuring the DNS	98
Configuring the Relay Device	99
Obtaining Configuration Files	99
Example Configuration	100
Manually Assigning IP Information	102
Checking and Saving the Running Configuration	102
Modifying the Startup Configuration	104
Default Boot Configuration	104
Automatically Downloading a Configuration File	104
Specifying the Filename to Read and Write the System Configuration	104
Booting Manually	105
Booting a Specific Software Image	106
Controlling Environment Variables	107
Scheduling a Reload of the Software Image	108
Configuring a Scheduled Reload	109
Displaying Scheduled Reload Information	110
Configuring Cisco IOS CNS Agents	111
Understanding Cisco Configuration Engine Software	111
Configuration Service	112
Event Service	113
NameSpace Mapper	113
What You Should Know About the CNS IDs and Device Hostnames	113
ConfigID	113
DeviceID	114
Hostname and DeviceID	114
Using Hostname, DeviceID, and ConfigID	114
Understanding Cisco IOS Agents	115
Initial Configuration	115
Incremental (Partial) Configuration	116
Synchronized Configuration	116
Configuring Cisco IOS Agents	116
Enabling Automated CNS Configuration	116
Enabling the CNS Event Agent	118
Enabling the Cisco IOS CNS Agent	119
Enabling an Initial Configuration	119
Enabling a Partial Configuration	121
Displaying CNS Configuration	122
Managing Switch Stacks	123
Understanding Switch Stacks	123
Switch Stack Membership	125
Stack Master Election and Re-Election	126
Switch Stack Bridge ID and Router MAC Address	128
Stack Member Numbers	128
Stack Member Priority Values	129
Switch Stack Offline Configuration	129
Effects of Adding a Provisioned Switch to a Switch Stack	130
Effects of Replacing a Provisioned Switch in a Switch Stack	131
Effects of Removing a Provisioned Switch from a Switch Stack	131
Hardware Compatibility and SDM Mismatch Mode in Switch Stacks	132
Switch Stack Software Compatibility Recommendations	132
Stack Protocol Version Compatibility	132
Major Version Number Incompatibility Among Switches	133
Minor Version Number Incompatibility Among Switches	133
Understanding Auto-Upgrade and Auto-Advise	133
Auto-Upgrade and Auto-Advise Example Messages	134
Incompatible Software and Stack Member Image Upgrades	136
Switch Stack Configuration Files	136
Additional Considerations for System-Wide Configuration on Switch Stacks	137
Switch Stack Management Connectivity	138
Connectivity to the Switch Stack Through an IP Address	138
Connectivity to the Switch Stack Through an SSH Session	138
Connectivity to the Switch Stack Through Console Ports	138
Connectivity to Specific Stack Members	139
Switch Stack Configuration Scenarios	139
Configuring the Switch Stack	141
Default Switch Stack Configuration	141
Enabling Persistent MAC Address	141
Assigning Stack Member Information	144
Assigning a Stack Member Number	144
Setting the Stack Member Priority Value	144
Provisioning a New Member for a Switch Stack	145
Accessing the CLI of a Specific Stack Member	147
Displaying Switch Stack Information	147
Clustering Switches	149
Understanding Switch Clusters	149
Cluster Command Switch Characteristics	151
Standby Cluster Command Switch Characteristics	151
Candidate Switch and Cluster Member Switch Characteristics	152
Planning a Switch Cluster	152
Automatic Discovery of Cluster Candidates and Members	153
Discovery Through CDP Hops	153
Discovery Through Non-CDP-Capable and Noncluster-Capable Devices	154
Discovery Through Different VLANs	155
Discovery Through Different Management VLANs	155
Discovery Through Routed Ports	156
Discovery of Newly Installed Switches	157
HSRP and Standby Cluster Command Switches	158
Virtual IP Addresses	159
Other Considerations for Cluster Standby Groups	159
Automatic Recovery of Cluster Configuration	160
IP Addresses	161
Hostnames	161
Passwords	162
SNMP Community Strings	162
Switch Clusters and Switch Stacks	163
TACACS+ and RADIUS	164
LRE Profiles	164
Using the CLI to Manage Switch Clusters	164
Catalyst1900 and Catalyst2820 CLI Considerations	165
Using SNMP to Manage Switch Clusters	165
Administering the Switch	167
Managing the System Time and Date	167
Understanding the System Clock	167
Understanding Network Time Protocol	168
Configuring NTP	169
Default NTP Configuration	170
Configuring NTP Authentication	170
Configuring NTP Associations	171
Configuring NTP Broadcast Service	172
Configuring NTP Access Restrictions	174
Configuring the Source IP Address for NTP Packets	176
Displaying the NTP Configuration	177
Configuring Time and Date Manually	177
Setting the System Clock	177
Displaying the Time and Date Configuration	178
Configuring the Time Zone	178
Configuring Summer Time (Daylight Saving Time)	179
Configuring a System Name and Prompt	180
Default System Name and Prompt Configuration	181
Configuring a System Name	181
Understanding DNS	181
Default DNS Configuration	182
Setting Up DNS	182
Displaying the DNS Configuration	183
Creating a Banner	183
Default Banner Configuration	183
Configuring a Message-of-the-Day Login Banner	184
Configuring a Login Banner	185
Managing the MAC Address Table	185
Building the Address Table	186
MAC Addresses and VLANs	186
MAC Addresses and Switch Stacks	187
Default MAC Address Table Configuration	187
Changing the Address Aging Time	187
Removing Dynamic Address Entries	188
Configuring MAC Address Notification Traps	188
Adding and Removing Static Address Entries	190
Configuring Unicast MAC Address Filtering	191
Displaying Address Table Entries	193
Managing the ARP Table	193
Configuring SDM Templates	195
Understanding the SDM Templates	195
Dual IPv4 and IPv6 SDM Templates	196
SDM Templates and Switch Stacks	197
Configuring the Switch SDM Template	198
Default SDM Template	199
SDM Template Configuration Guidelines	199
Setting the SDM Template	200
Displaying the SDM Templates	201
Configuring Switch-Based Authentication	205
Preventing Unauthorized Access to Your Switch	205
Protecting Access to Privileged EXEC Commands	206
Default Password and Privilege Level Configuration	206
Setting or Changing a Static Enable Password	207
Protecting Enable and Enable Secret Passwords with Encryption	207
Disabling Password Recovery	209
Setting a Telnet Password for a Terminal Line	210
Configuring Username and Password Pairs	210
Configuring Multiple Privilege Levels	211
Setting the Privilege Level for a Command	212
Changing the Default Privilege Level for Lines	213
Logging into and Exiting a Privilege Level	213
Controlling Switch Access with TACACS+	214
Understanding TACACS+	214
TACACS+ Operation	216
Configuring TACACS+	216
Default TACACS+ Configuration	217
Identifying the TACACS+ Server Host and Setting the Authentication Key	217
Configuring TACACS+ Login Authentication	218
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services	220
Starting TACACS+ Accounting	221
Displaying the TACACS+ Configuration	221
Controlling Switch Access with RADIUS	221
Understanding RADIUS	222
RADIUS Operation	223
Configuring RADIUS	224
Default RADIUS Configuration	224
Identifying the RADIUS Server Host	224
Configuring RADIUS Login Authentication	227
Defining AAA Server Groups	229
Configuring RADIUS Authorization for User Privileged Access and Network Services	231
Starting RADIUS Accounting	232
Configuring Settings for All RADIUS Servers	233
Configuring the Switch to Use Vendor-Specific RADIUS Attributes	233
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication	235
Displaying the RADIUS Configuration	235
Controlling Switch Access with Kerberos	236
Understanding Kerberos	236
Kerberos Operation	238
Authenticating to a Boundary Switch	238
Obtaining a TGT from a KDC	239
Authenticating to Network Services	239
Configuring Kerberos	239
Configuring the Switch for Local Authentication and Authorization	240
Configuring the Switch for Secure Shell	241
Understanding SSH	242
SSH Servers, Integrated Clients, and Supported Versions	242
Limitations	243
Configuring SSH	243
Configuration Guidelines	243
Setting Up the Switch to Run SSH	244
Configuring the SSH Server	245
Displaying the SSH Configuration and Status	245
Configuring the Switch for Secure Socket Layer HTTP	246
Understanding Secure HTTP Servers and Clients	246
Certificate Authority Trustpoints	246
CipherSuites	248
Configuring Secure HTTP Servers and Clients	248
Default SSL Configuration	248
SSL Configuration Guidelines	249
Configuring a CA Trustpoint	249
Configuring the Secure HTTP Server	250
Configuring the Secure HTTP Client	251
Displaying Secure HTTP Server and Client Status	252
Configuring the Switch for Secure Copy Protocol	252
Information About Secure Copy	253
Configuring IEEE 802.1x Port-Based Authentication	255
Understanding IEEE 802.1x Port-Based Authentication	255
Device Roles	256
Authentication Process	257
Authentication Initiation and Message Exchange	259
Ports in Authorized and Unauthorized States	261
IEEE 802.1x Authentication and Switch Stacks	262
IEEE 802.1x Host Mode	262
IEEE 802.1x Accounting	263
IEEE 802.1x Accounting Attribute-Value Pairs	263
Using IEEE 802.1x Authentication with VLAN Assignment	264
Using IEEE 802.1x Authentication with Per-User ACLs	265
Using IEEE 802.1x Authentication with Guest VLAN	267
Using IEEE 802.1x Authentication with Restricted VLAN	268
Using IEEE 802.1x Authentication with Inaccessible Authentication Bypass	269
Using IEEE 802.1x Authentication with Voice VLAN Ports	270
Using IEEE 802.1x Authentication with Port Security	271
Using IEEE 802.1x Authentication with Wake-on-LAN	272
Using IEEE 802.1x Authentication with MAC Authentication Bypass	272
Using Network Admission Control Layer 2 IEEE 802.1x Validation	273
Using Multidomain Authentication	274
Using Web Authentication	275
Configuring IEEE 802.1x Authentication	275
Default IEEE 802.1x Authentication Configuration	276
IEEE 802.1x Authentication Configuration Guidelines	277
IEEE 802.1x Authentication	277
VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication Bypass	278
MAC Authentication Bypass	279
Upgrading from a Previous Software Release	280
Configuring IEEE 802.1x Authentication	280
Configuring the Switch-to-RADIUS-Server Communication	281
Configuring the Host Mode	283
Configuring Periodic Re-Authentication	284
Manually Re-Authenticating a Client Connected to a Port	284
Changing the Quiet Period	285
Changing the Switch-to-Client Retransmission Time	285
Setting the Switch-to-Client Frame-Retransmission Number	286
Setting the Re-Authentication Number	286
Configuring IEEE 802.1x Accounting	287
Configuring a Guest VLAN	288
Configuring a Restricted VLAN	289
Configuring the Inaccessible Authentication Bypass Feature	291
Configuring IEEE 802.1x Authentication with WoL	293
Configuring MAC Authentication Bypass	294
Configuring NAC Layer 2 IEEE 802.1x Validation	295
Configuring Web Authentication	295
Disabling IEEE 802.1x Authentication on the Port	298
Resetting the IEEE 802.1x Authentication Configuration to the Default Values	299
Displaying IEEE 802.1x Statistics and Status	300
Configuring Interface Characteristics	301
Understanding Interface Types	301
Port-Based VLANs	302
Switch Ports	302
Access Ports	303
Trunk Ports	303
Tunnel Ports	304
Routed Ports	304
Switch Virtual Interfaces	305
EtherChannel Port Groups	306
10-Gigabit Ethernet Interfaces	306
Power over Ethernet Ports	306
Supported Protocols and Standards	307
Powered-Device Detection and Initial Power Allocation	307
Power Management Modes	308
Connecting Interfaces	309
Using Interface Configuration Mode	310
Procedures for Configuring Interfaces	311
Configuring a Range of Interfaces	312
Configuring and Using Interface Range Macros	313
Configuring Ethernet Interfaces	315
Default Ethernet Interface Configuration	315
Configuration Guidelines for 10-Gigabit Ethernet Interfaces	317
Configuring Interface Speed and Duplex Mode	317
Speed and Duplex Configuration Guidelines	317
Setting the Interface Speed and Duplex Parameters	318
Configuring IEEE 802.3x Flow Control	319
Configuring Auto-MDIX on an Interface	320
Configuring a Power Management Mode on a PoE Port	321
Budgeting Power for Devices Connected to a PoE Port	323
Adding a Description for an Interface	324
Configuring Layer 3 Interfaces	325
Configuring the System MTU	327
Monitoring and Maintaining the Interfaces	328
Monitoring Interface Status	329
Clearing and Resetting Interfaces and Counters	330
Shutting Down and Restarting the Interface	330
Configuring Smartports Macros	331
Understanding Smartports Macros	331
Configuring Smartports Macros	332
Default Smartports Macro Configuration	332
Smartports Macro Configuration Guidelines	333
Creating Smartports Macros	334
Applying Smartports Macros	335
Applying Cisco-Default Smartports Macros	336
Displaying Smartports Macros	338
Configuring VLANs	339
Understanding VLANs	339
Supported VLANs	340
VLAN Port Membership Modes	341
Configuring Normal-Range VLANs	342
Token Ring VLANs	344
Normal-Range VLAN Configuration Guidelines	344
VLAN Configuration Mode Options	345
VLAN Configuration in config-vlan Mode	345
VLAN Configuration in VLAN Database Configuration Mode	345
Saving VLAN Configuration	345
Default Ethernet VLAN Configuration	346
Creating or Modifying an Ethernet VLAN	347
Deleting a VLAN	348
Assigning Static-Access Ports to a VLAN	349
Configuring Extended-Range VLANs	350
Default VLAN Configuration	350
Extended-Range VLAN Configuration Guidelines	351
Creating an Extended-Range VLAN	352
Creating an Extended-Range VLAN with an Internal VLAN ID	353
Displaying VLANs	354
Configuring VLAN Trunks	354
Trunking Overview	354
Encapsulation Types	356
IEEE 802.1Q Configuration Considerations	357
Default Layer 2 Ethernet Interface VLAN Configuration	357
Configuring an Ethernet Interface as a Trunk Port	357
Interaction with Other Features	358
Configuring a Trunk Port	358
Defining the Allowed VLANs on a Trunk	359
Changing the Pruning-Eligible List	360
Configuring the Native VLAN for Untagged Traffic	361
Configuring Trunk Ports for Load Sharing	362
Load Sharing Using STP Port Priorities	362
Load Sharing Using STP Path Cost	364
Configuring VMPS	366
Understanding VMPS	366
Dynamic-Access Port VLAN Membership	367
Default VMPS Client Configuration	367
VMPS Configuration Guidelines	367
Configuring the VMPS Client	368
Entering the IP Address of the VMPS	368
Configuring Dynamic-Access Ports on VMPS Clients	369
Reconfirming VLAN Memberships	369
Changing the Reconfirmation Interval	369
Changing the Retry Count	370
Monitoring the VMPS	370
Troubleshooting Dynamic-Access Port VLAN Membership	371
VMPS Configuration Example	371
Configuring VTP	373
Understanding VTP	373
The VTP Domain	374
VTP Modes	375
VTP Advertisements	375
VTP Version 2	376
VTP Pruning	376
VTP and Switch Stacks	378
Configuring VTP	378
Default VTP Configuration	379
VTP Configuration Options	379
VTP Configuration in Global Configuration Mode	379
VTP Configuration in VLAN Database Configuration Mode	380
VTP Configuration Guidelines	380
Domain Names	380
Passwords	380
VTP Version	381
Configuration Requirements	381
Configuring a VTP Server	381
Configuring a VTP Client	383
Disabling VTP (VTP Transparent Mode)	384
Enabling VTP Version 2	385
Enabling VTP Pruning	386
Adding a VTP Client Switch to a VTP Domain	386
Monitoring VTP	388
Configuring Voice VLAN	389
Understanding Voice VLAN	389
Cisco IP Phone Voice Traffic	390
Cisco IP Phone Data Traffic	390
Configuring Voice VLAN	391
Default Voice VLAN Configuration	391
Voice VLAN Configuration Guidelines	391
Configuring a Port Connected to a Cisco7960 IP Phone	392
Configuring Cisco IP Phone Voice Traffic	393
Configuring the Priority of Incoming Data Frames	394
Displaying Voice VLAN	394
Configuring Private VLANs	395
Understanding Private VLANs	395
IP Addressing Scheme with Private VLANs	397
Private VLANs across Multiple Switches	398
Private-VLAN Interaction with Other Features	398
Private VLANs and Unicast, Broadcast, and Multicast Traffic	399
Private VLANs and SVIs	399
Private VLANs and Switch Stacks	400
Configuring Private VLANs	400
Tasks for Configuring Private VLANs	400
Default Private-VLAN Configuration	401
Private-VLAN Configuration Guidelines	401
Secondary and Primary VLAN Configuration	401
Private-VLAN Port Configuration	402
Limitations with Other Features	403
Configuring and Associating VLANs in a Private VLAN	404
Configuring a Layer 2 Interface as a Private-VLAN Host Port	406
Configuring a Layer 2 Interface as a Private-VLAN Promiscuous Port	407
Mapping Secondary VLANs to a Primary VLAN Layer 3 VLAN Interface	408
Monitoring Private VLANs	409
Configuring IEEE 802.1Q and Layer 2 Protocol Tunneling	411
Understanding IEEE 802.1Q Tunneling	411
Configuring IEEE 802.1Q Tunneling	414
Default IEEE 802.1Q Tunneling Configuration	414
IEEE 802.1Q Tunneling Configuration Guidelines	414
Native VLANs	414
System MTU	415
IEEE 802.1Q Tunneling and Other Features	416
Configuring an IEEE 802.1Q Tunneling Port	416
Understanding Layer 2 Protocol Tunneling	417
Configuring Layer 2 Protocol Tunneling	420
Default Layer 2 Protocol Tunneling Configuration	421
Layer 2 Protocol Tunneling Configuration Guidelines	422
Configuring Layer 2 Protocol Tunneling	423
Configuring Layer 2 Tunneling for EtherChannels	424
Configuring the SP Edge Switch	424