Home » Cisco Manuals » Wireless » Cisco 3750G » Manual Viewer

Cisco 3750G Configuration Guide - Page 675

VLAN Maps, Handling Fragmented and Unfragmented Traffic

UPC - 882658121319

Add to My Manuals
Save this manual to your list of manuals

Page 675 highlights

Chapter 32 Configuring Network Security with ACLs Understanding ACLs VLAN Maps As with port ACLs, the switch examines ACLs associated with features configured on a given interface. However, router ACLs are supported in both directions. As packets enter the switch on an interface, ACLs associated with all inbound features configured on that interface are examined. After packets are routed and before they are forwarded to the next hop, all ACLs associated with outbound features configured on the egress interface are examined. ACLs permit or deny packet forwarding based on how the packet matches the entries in the ACL, and can be used to control access to a network or to part of a network. In Figure 32-1, ACLs applied at the router input allow Host A to access the Human Resources network, but prevent Host B from accessing the same network. Use VLAN ACLs or VLAN maps to access-control all traffic. You can apply VLAN maps to all packets that are routed into or out of a VLAN or are bridged within a VLAN in the stack. Use VLAN maps for security packet filtering. VLAN maps are not defined by direction (input or output). You can configure VLAN maps to match Layer 3 addresses for IPv4 traffic. All non-IP protocols are access-controlled through MAC addresses and Ethertype using MAC VLAN maps. (IP traffic is not access controlled by MAC VLAN maps.) You can enforce VLAN maps only on packets going through the switch; you cannot enforce VLAN maps on traffic between hosts on a hub or on another switch connected to this switch. With VLAN maps, forwarding of packets is permitted or denied, based on the action specified in the map. Figure 32-2 shows how a VLAN map is applied to prevent a specific type of traffic from Host A in VLAN 10 from being forwarded. You can apply only one VLAN map to a VLAN. Figure 32-2 Using VLAN Maps to Control Traffic Host A (VLAN 10) Host B (VLAN 10) = VLAN map denying specific type of traffic from Host A = Packet 92919 Handling Fragmented and Unfragmented Traffic IP packets can be fragmented as they cross the network. When this happens, only the fragment containing the beginning of the packet contains the Layer 4 information, such as TCP or UDP port numbers, ICMP type and code, and so on. All other fragments are missing this information. Some ACEs do not check Layer 4 information and therefore can be applied to all packet fragments. ACEs that do test Layer 4 information cannot be applied in the standard manner to most of the fragments in a fragmented IP packet. When the fragment contains no Layer 4 information and the ACE tests some Layer 4 information, the matching rules are modified: • Permit ACEs that check the Layer 3 information in the fragment (including protocol type, such as TCP, UDP, and so on) are considered to match the fragment regardless of what the missing Layer 4 information might have been. OL-8550-02 Catalyst 3750 Switch Software Configuration Guide 32-5

Section	Page
Catalyst 3750 SwitchSoftware Configuration Guide	1
Contents	3
Preface	43
Audience	43
Purpose	43
Conventions	44
Related Publications	44
Obtaining Documentation	46
Cisco.com	46
Product Documentation DVD	46
Ordering Documentation	46
Documentation Feedback	47
Cisco Product Security Overview	47
Reporting Security Problems in Cisco Products	47
Product Alerts and Field Notices	48
Obtaining Technical Assistance	48
Cisco Support Website	48
Submitting a Service Request	49
Definitions of Service Request Severity	49
Obtaining Additional Publications and Information	50
Overview	53
Features	53
Ease-of-Deployment and Ease-of-Use Features	54
Performance Features	56
Management Options	57
Manageability Features	57
Availability and Redundancy Features	58
VLAN Features	59
Security Features	60
QoS and CoS Features	61
Layer3 Features	63
Power over Ethernet Features	64
Monitoring Features	64
Default Settings After Initial Switch Configuration	64
Network Configuration Examples	67
Design Concepts for Using the Switch	68
Small to Medium-Sized Network Using Catalyst 3750 Switches	73
Large Network Using Catalyst 3750 Switches	75
Multidwelling Network Using Catalyst 3750 Switches	77
Long-Distance, High-Bandwidth Transport Configuration	78
Where to Go Next	79
Using the Command-Line Interface	81
Understanding Command Modes	81
Understanding the Help System	83
Understanding Abbreviated Commands	84
Understanding no and default Forms of Commands	84
Understanding CLI Error Messages	85
Using Configuration Logging	85
Using Command History	86
Changing the Command History Buffer Size	86
Recalling Commands	86
Disabling the Command History Feature	87
Using Editing Features	87
Enabling and Disabling Editing Features	87
Editing Commands through Keystrokes	87
Editing Command Lines that Wrap	89
Searching and Filtering Output of show and more Commands	90
Accessing the CLI	90
Accessing the CLI through a Console Connection or through Telnet	90
Assigning the Switch IP Address and Default Gateway	93
Understanding the Boot Process	93
Assigning Switch Information	94
Default Switch Information	95
Understanding DHCP-Based Autoconfiguration	95
DHCP Client Request Process	96
Configuring DHCP-Based Autoconfiguration	97
DHCP Server Configuration Guidelines	97
Configuring the TFTP Server	98
Configuring the DNS	98
Configuring the Relay Device	99
Obtaining Configuration Files	99
Example Configuration	100
Manually Assigning IP Information	102
Checking and Saving the Running Configuration	102
Modifying the Startup Configuration	104
Default Boot Configuration	104
Automatically Downloading a Configuration File	104
Specifying the Filename to Read and Write the System Configuration	104
Booting Manually	105
Booting a Specific Software Image	106
Controlling Environment Variables	107
Scheduling a Reload of the Software Image	108
Configuring a Scheduled Reload	109
Displaying Scheduled Reload Information	110
Configuring Cisco IOS CNS Agents	111
Understanding Cisco Configuration Engine Software	111
Configuration Service	112
Event Service	113
NameSpace Mapper	113
What You Should Know About the CNS IDs and Device Hostnames	113
ConfigID	113
DeviceID	114
Hostname and DeviceID	114
Using Hostname, DeviceID, and ConfigID	114
Understanding Cisco IOS Agents	115
Initial Configuration	115
Incremental (Partial) Configuration	116
Synchronized Configuration	116
Configuring Cisco IOS Agents	116
Enabling Automated CNS Configuration	116
Enabling the CNS Event Agent	118
Enabling the Cisco IOS CNS Agent	119
Enabling an Initial Configuration	119
Enabling a Partial Configuration	121
Displaying CNS Configuration	122
Managing Switch Stacks	123
Understanding Switch Stacks	123
Switch Stack Membership	125
Stack Master Election and Re-Election	126
Switch Stack Bridge ID and Router MAC Address	128
Stack Member Numbers	128
Stack Member Priority Values	129
Switch Stack Offline Configuration	129
Effects of Adding a Provisioned Switch to a Switch Stack	130
Effects of Replacing a Provisioned Switch in a Switch Stack	131
Effects of Removing a Provisioned Switch from a Switch Stack	131
Hardware Compatibility and SDM Mismatch Mode in Switch Stacks	132
Switch Stack Software Compatibility Recommendations	132
Stack Protocol Version Compatibility	132
Major Version Number Incompatibility Among Switches	133
Minor Version Number Incompatibility Among Switches	133
Understanding Auto-Upgrade and Auto-Advise	133
Auto-Upgrade and Auto-Advise Example Messages	134
Incompatible Software and Stack Member Image Upgrades	136
Switch Stack Configuration Files	136
Additional Considerations for System-Wide Configuration on Switch Stacks	137
Switch Stack Management Connectivity	138
Connectivity to the Switch Stack Through an IP Address	138
Connectivity to the Switch Stack Through an SSH Session	138
Connectivity to the Switch Stack Through Console Ports	138
Connectivity to Specific Stack Members	139
Switch Stack Configuration Scenarios	139
Configuring the Switch Stack	141
Default Switch Stack Configuration	141
Enabling Persistent MAC Address	141
Assigning Stack Member Information	144
Assigning a Stack Member Number	144
Setting the Stack Member Priority Value	144
Provisioning a New Member for a Switch Stack	145
Accessing the CLI of a Specific Stack Member	147
Displaying Switch Stack Information	147
Clustering Switches	149
Understanding Switch Clusters	149
Cluster Command Switch Characteristics	151
Standby Cluster Command Switch Characteristics	151
Candidate Switch and Cluster Member Switch Characteristics	152
Planning a Switch Cluster	152
Automatic Discovery of Cluster Candidates and Members	153
Discovery Through CDP Hops	153
Discovery Through Non-CDP-Capable and Noncluster-Capable Devices	154
Discovery Through Different VLANs	155
Discovery Through Different Management VLANs	155
Discovery Through Routed Ports	156
Discovery of Newly Installed Switches	157
HSRP and Standby Cluster Command Switches	158
Virtual IP Addresses	159
Other Considerations for Cluster Standby Groups	159
Automatic Recovery of Cluster Configuration	160
IP Addresses	161
Hostnames	161
Passwords	162
SNMP Community Strings	162
Switch Clusters and Switch Stacks	163
TACACS+ and RADIUS	164
LRE Profiles	164
Using the CLI to Manage Switch Clusters	164
Catalyst1900 and Catalyst2820 CLI Considerations	165
Using SNMP to Manage Switch Clusters	165
Administering the Switch	167
Managing the System Time and Date	167
Understanding the System Clock	167
Understanding Network Time Protocol	168
Configuring NTP	169
Default NTP Configuration	170
Configuring NTP Authentication	170
Configuring NTP Associations	171
Configuring NTP Broadcast Service	172
Configuring NTP Access Restrictions	174
Configuring the Source IP Address for NTP Packets	176
Displaying the NTP Configuration	177
Configuring Time and Date Manually	177
Setting the System Clock	177
Displaying the Time and Date Configuration	178
Configuring the Time Zone	178
Configuring Summer Time (Daylight Saving Time)	179
Configuring a System Name and Prompt	180
Default System Name and Prompt Configuration	181
Configuring a System Name	181
Understanding DNS	181
Default DNS Configuration	182
Setting Up DNS	182
Displaying the DNS Configuration	183
Creating a Banner	183
Default Banner Configuration	183
Configuring a Message-of-the-Day Login Banner	184
Configuring a Login Banner	185
Managing the MAC Address Table	185
Building the Address Table	186
MAC Addresses and VLANs	186
MAC Addresses and Switch Stacks	187
Default MAC Address Table Configuration	187
Changing the Address Aging Time	187
Removing Dynamic Address Entries	188
Configuring MAC Address Notification Traps	188
Adding and Removing Static Address Entries	190
Configuring Unicast MAC Address Filtering	191
Displaying Address Table Entries	193
Managing the ARP Table	193
Configuring SDM Templates	195
Understanding the SDM Templates	195
Dual IPv4 and IPv6 SDM Templates	196
SDM Templates and Switch Stacks	197
Configuring the Switch SDM Template	198
Default SDM Template	199
SDM Template Configuration Guidelines	199
Setting the SDM Template	200
Displaying the SDM Templates	201
Configuring Switch-Based Authentication	205
Preventing Unauthorized Access to Your Switch	205
Protecting Access to Privileged EXEC Commands	206
Default Password and Privilege Level Configuration	206
Setting or Changing a Static Enable Password	207
Protecting Enable and Enable Secret Passwords with Encryption	207
Disabling Password Recovery	209
Setting a Telnet Password for a Terminal Line	210
Configuring Username and Password Pairs	210
Configuring Multiple Privilege Levels	211
Setting the Privilege Level for a Command	212
Changing the Default Privilege Level for Lines	213
Logging into and Exiting a Privilege Level	213
Controlling Switch Access with TACACS+	214
Understanding TACACS+	214
TACACS+ Operation	216
Configuring TACACS+	216
Default TACACS+ Configuration	217
Identifying the TACACS+ Server Host and Setting the Authentication Key	217
Configuring TACACS+ Login Authentication	218
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services	220
Starting TACACS+ Accounting	221
Displaying the TACACS+ Configuration	221
Controlling Switch Access with RADIUS	221
Understanding RADIUS	222
RADIUS Operation	223
Configuring RADIUS	224
Default RADIUS Configuration	224
Identifying the RADIUS Server Host	224
Configuring RADIUS Login Authentication	227
Defining AAA Server Groups	229
Configuring RADIUS Authorization for User Privileged Access and Network Services	231
Starting RADIUS Accounting	232
Configuring Settings for All RADIUS Servers	233
Configuring the Switch to Use Vendor-Specific RADIUS Attributes	233
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication	235
Displaying the RADIUS Configuration	235
Controlling Switch Access with Kerberos	236
Understanding Kerberos	236
Kerberos Operation	238
Authenticating to a Boundary Switch	238
Obtaining a TGT from a KDC	239
Authenticating to Network Services	239
Configuring Kerberos	239
Configuring the Switch for Local Authentication and Authorization	240
Configuring the Switch for Secure Shell	241
Understanding SSH	242
SSH Servers, Integrated Clients, and Supported Versions	242
Limitations	243
Configuring SSH	243
Configuration Guidelines	243
Setting Up the Switch to Run SSH	244
Configuring the SSH Server	245
Displaying the SSH Configuration and Status	245
Configuring the Switch for Secure Socket Layer HTTP	246
Understanding Secure HTTP Servers and Clients	246
Certificate Authority Trustpoints	246
CipherSuites	248
Configuring Secure HTTP Servers and Clients	248
Default SSL Configuration	248
SSL Configuration Guidelines	249
Configuring a CA Trustpoint	249
Configuring the Secure HTTP Server	250
Configuring the Secure HTTP Client	251
Displaying Secure HTTP Server and Client Status	252
Configuring the Switch for Secure Copy Protocol	252
Information About Secure Copy	253
Configuring IEEE 802.1x Port-Based Authentication	255
Understanding IEEE 802.1x Port-Based Authentication	255
Device Roles	256
Authentication Process	257
Authentication Initiation and Message Exchange	259
Ports in Authorized and Unauthorized States	261
IEEE 802.1x Authentication and Switch Stacks	262
IEEE 802.1x Host Mode	262
IEEE 802.1x Accounting	263
IEEE 802.1x Accounting Attribute-Value Pairs	263
Using IEEE 802.1x Authentication with VLAN Assignment	264
Using IEEE 802.1x Authentication with Per-User ACLs	265
Using IEEE 802.1x Authentication with Guest VLAN	267
Using IEEE 802.1x Authentication with Restricted VLAN	268
Using IEEE 802.1x Authentication with Inaccessible Authentication Bypass	269
Using IEEE 802.1x Authentication with Voice VLAN Ports	270
Using IEEE 802.1x Authentication with Port Security	271
Using IEEE 802.1x Authentication with Wake-on-LAN	272
Using IEEE 802.1x Authentication with MAC Authentication Bypass	272
Using Network Admission Control Layer 2 IEEE 802.1x Validation	273
Using Multidomain Authentication	274
Using Web Authentication	275
Configuring IEEE 802.1x Authentication	275
Default IEEE 802.1x Authentication Configuration	276
IEEE 802.1x Authentication Configuration Guidelines	277
IEEE 802.1x Authentication	277
VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication Bypass	278
MAC Authentication Bypass	279
Upgrading from a Previous Software Release	280
Configuring IEEE 802.1x Authentication	280
Configuring the Switch-to-RADIUS-Server Communication	281
Configuring the Host Mode	283
Configuring Periodic Re-Authentication	284
Manually Re-Authenticating a Client Connected to a Port	284
Changing the Quiet Period	285
Changing the Switch-to-Client Retransmission Time	285
Setting the Switch-to-Client Frame-Retransmission Number	286
Setting the Re-Authentication Number	286
Configuring IEEE 802.1x Accounting	287
Configuring a Guest VLAN	288
Configuring a Restricted VLAN	289
Configuring the Inaccessible Authentication Bypass Feature	291
Configuring IEEE 802.1x Authentication with WoL	293
Configuring MAC Authentication Bypass	294
Configuring NAC Layer 2 IEEE 802.1x Validation	295
Configuring Web Authentication	295
Disabling IEEE 802.1x Authentication on the Port	298
Resetting the IEEE 802.1x Authentication Configuration to the Default Values	299
Displaying IEEE 802.1x Statistics and Status	300
Configuring Interface Characteristics	301
Understanding Interface Types	301
Port-Based VLANs	302
Switch Ports	302
Access Ports	303
Trunk Ports	303
Tunnel Ports	304
Routed Ports	304
Switch Virtual Interfaces	305
EtherChannel Port Groups	306
10-Gigabit Ethernet Interfaces	306
Power over Ethernet Ports	306
Supported Protocols and Standards	307
Powered-Device Detection and Initial Power Allocation	307
Power Management Modes	308
Connecting Interfaces	309
Using Interface Configuration Mode	310
Procedures for Configuring Interfaces	311
Configuring a Range of Interfaces	312
Configuring and Using Interface Range Macros	313
Configuring Ethernet Interfaces	315
Default Ethernet Interface Configuration	315
Configuration Guidelines for 10-Gigabit Ethernet Interfaces	317
Configuring Interface Speed and Duplex Mode	317
Speed and Duplex Configuration Guidelines	317
Setting the Interface Speed and Duplex Parameters	318
Configuring IEEE 802.3x Flow Control	319
Configuring Auto-MDIX on an Interface	320
Configuring a Power Management Mode on a PoE Port	321
Budgeting Power for Devices Connected to a PoE Port	323
Adding a Description for an Interface	324
Configuring Layer 3 Interfaces	325
Configuring the System MTU	327
Monitoring and Maintaining the Interfaces	328
Monitoring Interface Status	329
Clearing and Resetting Interfaces and Counters	330
Shutting Down and Restarting the Interface	330
Configuring Smartports Macros	331
Understanding Smartports Macros	331
Configuring Smartports Macros	332
Default Smartports Macro Configuration	332
Smartports Macro Configuration Guidelines	333
Creating Smartports Macros	334
Applying Smartports Macros	335
Applying Cisco-Default Smartports Macros	336
Displaying Smartports Macros	338
Configuring VLANs	339
Understanding VLANs	339
Supported VLANs	340
VLAN Port Membership Modes	341
Configuring Normal-Range VLANs	342
Token Ring VLANs	344
Normal-Range VLAN Configuration Guidelines	344
VLAN Configuration Mode Options	345
VLAN Configuration in config-vlan Mode	345
VLAN Configuration in VLAN Database Configuration Mode	345
Saving VLAN Configuration	345
Default Ethernet VLAN Configuration	346
Creating or Modifying an Ethernet VLAN	347
Deleting a VLAN	348
Assigning Static-Access Ports to a VLAN	349
Configuring Extended-Range VLANs	350
Default VLAN Configuration	350
Extended-Range VLAN Configuration Guidelines	351
Creating an Extended-Range VLAN	352
Creating an Extended-Range VLAN with an Internal VLAN ID	353
Displaying VLANs	354
Configuring VLAN Trunks	354
Trunking Overview	354
Encapsulation Types	356
IEEE 802.1Q Configuration Considerations	357
Default Layer 2 Ethernet Interface VLAN Configuration	357
Configuring an Ethernet Interface as a Trunk Port	357
Interaction with Other Features	358
Configuring a Trunk Port	358
Defining the Allowed VLANs on a Trunk	359
Changing the Pruning-Eligible List	360
Configuring the Native VLAN for Untagged Traffic	361
Configuring Trunk Ports for Load Sharing	362
Load Sharing Using STP Port Priorities	362
Load Sharing Using STP Path Cost	364
Configuring VMPS	366
Understanding VMPS	366
Dynamic-Access Port VLAN Membership	367
Default VMPS Client Configuration	367
VMPS Configuration Guidelines	367
Configuring the VMPS Client	368
Entering the IP Address of the VMPS	368
Configuring Dynamic-Access Ports on VMPS Clients	369
Reconfirming VLAN Memberships	369
Changing the Reconfirmation Interval	369
Changing the Retry Count	370
Monitoring the VMPS	370
Troubleshooting Dynamic-Access Port VLAN Membership	371
VMPS Configuration Example	371
Configuring VTP	373
Understanding VTP	373
The VTP Domain	374
VTP Modes	375
VTP Advertisements	375
VTP Version 2	376
VTP Pruning	376
VTP and Switch Stacks	378
Configuring VTP	378
Default VTP Configuration	379
VTP Configuration Options	379
VTP Configuration in Global Configuration Mode	379
VTP Configuration in VLAN Database Configuration Mode	380
VTP Configuration Guidelines	380
Domain Names	380
Passwords	380
VTP Version	381
Configuration Requirements	381
Configuring a VTP Server	381
Configuring a VTP Client	383
Disabling VTP (VTP Transparent Mode)	384
Enabling VTP Version 2	385
Enabling VTP Pruning	386
Adding a VTP Client Switch to a VTP Domain	386
Monitoring VTP	388
Configuring Voice VLAN	389
Understanding Voice VLAN	389
Cisco IP Phone Voice Traffic	390
Cisco IP Phone Data Traffic	390
Configuring Voice VLAN	391
Default Voice VLAN Configuration	391
Voice VLAN Configuration Guidelines	391
Configuring a Port Connected to a Cisco7960 IP Phone	392
Configuring Cisco IP Phone Voice Traffic	393
Configuring the Priority of Incoming Data Frames	394
Displaying Voice VLAN	394
Configuring Private VLANs	395
Understanding Private VLANs	395
IP Addressing Scheme with Private VLANs	397
Private VLANs across Multiple Switches	398
Private-VLAN Interaction with Other Features	398
Private VLANs and Unicast, Broadcast, and Multicast Traffic	399
Private VLANs and SVIs	399
Private VLANs and Switch Stacks	400
Configuring Private VLANs	400
Tasks for Configuring Private VLANs	400
Default Private-VLAN Configuration	401
Private-VLAN Configuration Guidelines	401
Secondary and Primary VLAN Configuration	401
Private-VLAN Port Configuration	402
Limitations with Other Features	403
Configuring and Associating VLANs in a Private VLAN	404
Configuring a Layer 2 Interface as a Private-VLAN Host Port	406
Configuring a Layer 2 Interface as a Private-VLAN Promiscuous Port	407
Mapping Secondary VLANs to a Primary VLAN Layer 3 VLAN Interface	408
Monitoring Private VLANs	409
Configuring IEEE 802.1Q and Layer 2 Protocol Tunneling	411
Understanding IEEE 802.1Q Tunneling	411
Configuring IEEE 802.1Q Tunneling	414
Default IEEE 802.1Q Tunneling Configuration	414
IEEE 802.1Q Tunneling Configuration Guidelines	414
Native VLANs	414
System MTU	415
IEEE 802.1Q Tunneling and Other Features	416
Configuring an IEEE 802.1Q Tunneling Port	416
Understanding Layer 2 Protocol Tunneling	417
Configuring Layer 2 Protocol Tunneling	420
Default Layer 2 Protocol Tunneling Configuration	421
Layer 2 Protocol Tunneling Configuration Guidelines	422
Configuring Layer 2 Protocol Tunneling	423
Configuring Layer 2 Tunneling for EtherChannels	424
Configuring the SP Edge Switch	424

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204

Match case Limit results 1 per page

32-5

Catalyst 3750 Switch Software Configuration Guide

OL-8550-02

Chapter 32

Configuring Network Security with ACLs

Understanding ACLs

As with port ACLs, the switch examines ACLs associated with features configured on a given interface.

However, router ACLs are supported in both directions. As packets enter the switch on an interface,

ACLs associated with all inbound features configured on that interface are examined. After packets are

routed and before they are forwarded to the next hop, all ACLs associated with outbound features

configured on the egress interface are examined.

ACLs permit or deny packet forwarding based on how the packet matches the entries in the ACL, and

can be used to control access to a network or to part of a network. In

Figure 32-1

, ACLs applied at the

router input allow Host A to access the Human Resources network, but prevent Host B from accessing

the same network.

VLAN Maps

Use VLAN ACLs or VLAN maps to access-control

all

traffic. You can apply VLAN maps to all packets

that are routed into or out of a VLAN or are bridged within a VLAN in the stack.

Use VLAN maps for security packet filtering. VLAN maps are not defined by direction (input or output).

You can configure VLAN maps to match Layer 3 addresses for IPv4 traffic.

All non-IP protocols are access-controlled through MAC addresses and Ethertype using MAC VLAN

maps. (IP traffic

is not

access controlled by MAC VLAN maps.) You can enforce VLAN maps only on

packets going through the switch; you cannot enforce VLAN maps on traffic between hosts on a hub or

on another switch connected to this switch.

With VLAN maps, forwarding of packets is permitted or denied, based on the action specified in the

map.

Figure 32-2

shows how a VLAN map is applied to prevent a specific type of traffic from Host A in

VLAN 10 from being forwarded. You can apply only one VLAN map to a VLAN.

Figure 32-2

Using VLAN Maps to Control Traffic

Handling Fragmented and Unfragmented Traffic

IP packets can be fragmented as they cross the network. When this happens, only the fragment

containing the beginning of the packet contains the Layer 4 information, such as TCP or UDP port

numbers, ICMP type and code, and so on. All other fragments are missing this information.

Some ACEs do not check Layer 4 information and therefore can be applied to all packet fragments. ACEs

that do test Layer 4 information cannot be applied in the standard manner to most of the fragments in a

fragmented IP packet. When the fragment contains no Layer 4 information and the ACE tests some

Layer 4 information, the matching rules are modified:

•

Permit ACEs that check the Layer 3 information in the fragment (including protocol type, such as

TCP, UDP, and so on) are considered to match the fragment regardless of what the missing Layer 4

information might have been.

Host B

(VLAN 10)

Host A

(VLAN 10)

92919

VLAN map denying specific type

of traffic from Host A

Packet