Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.
IS_NEXUS_7010(config)# interface Ethernet2/2
IS_NEXUS_7010(config-if)# description Connected to Exchange Cisco 2960 24
IS_NEXUS_7010(config-if)# switchport trunk allowed vlan 1-14
IS_NEXUS_7010(config-if)# ip access-group 110 in

ERROR: RACL policies can be configured only on Layer-3 interface which is not a port-channel member. Note that port-channel members use the ACL policies applied on port-channel interface.

IS_NEXUS_7010(config-if)#   switchport
IS_NEXUS_7010(config-if)#   switchport mode trunk
IS_NEXUS_7010(config-if)#   switchport trunk allowed vlan 1-14

Can't configure ip access-group 110 in on trunk interface Ethernet2/2, it shows the error above. How do I resolve this?

share|improve this question

1 Answer 1

When you apply the ACL to a layer2 trunk, this is called a Port ACL, use the ip port access-group syntax to apply it instead of ip access-group... explicitly...

IS_NEXUS_7010(config)# interface Ethernet2/2
IS_NEXUS_7010(config-if)# description Connected to Exchange Cisco 2960 24
IS_NEXUS_7010(config-if)# switchport
IS_NEXUS_7010(config-if)# switchport mode trunk
IS_NEXUS_7010(config-if)# switchport trunk allowed vlan 1-14
IS_NEXUS_7010(config-if)# ip port access-group 110 in
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.