7

I have a question that I am having a very hard time wrapping my mind around, and I think you might be able to square me away.

When applying an access list to a VLAN interface (VLAN 32) in a L3 switch, for clients that are in VLAN 32 subnet, are they seen as coming into VLAN 32 on the way to being routed, or is the traffic coming out (exiting) the VLAN 32 interface? What about traffic coming from another VLAN?

I am trying to sort this out for the purpose of deciding on applying an access list to "in" or "out" traffic against the VLAN 32 interface.

Improve this question

4 Answers 4

Reset to default
5

This is often a confusing topic for users new to SVIs as it does seem to work a bit counter intuitively. Most people have a tendency to look at the SVI as some sort of "gateway" and that traffic leaving the VLAN should be outbound and vice versa.

However, it actually works in the opposite way because the SVI is a virtual router interface. It can help to think of the SVI as a physical interface on a physical router connected to the VLAN. From the perspective of this router, traffic arriving on the interface (the SVI) from the VLAN is inbound. Traffic from the rest of the network to the VLAN would be going out (or outbound) from the perspective of this interface.

As an example, take for instance the following SVI:

interface Vlan10
 ip address 10.1.1.1 255.255.255.0
 ip access-group VLAN10_IN in
 ip access-group VLAN10_OUT out

Now, let's say I want to prevent any traffic with spoofed IP addresses from leaving this VLAN. My access list may look like the below. Notice that while this traffic is outbound from the VLAN, it is inbound to the interface and as such is an inbound ACL.

Sw6500#sh ip access-lists VLAN10_IN
Extended IP access list VLAN10_IN
    10 permit ip 10.1.1.0 0.0.0.255 any
    20 deny ip any any

If I want to limit access to this VLAN so that devices with 192.168.1.0/24 addresses are blocked but all other 192.168.0.0/16 addresses are allowed, the ACL would look something like this:

Sw6500#sh ip access-lists VLAN10_OUT
Extended IP access list VLAN10_OUT
    10 deny ip 192.168.1.0 0.0.0.255 any
    20 permit ip 192.168.0.0 0.0.255.255 any
    30 deny ip any any

Please Note: These are not a complete working access lists; they are meant only as examples. While they may work in certain environments, it may create problems if you try to use it. For instance, it will not allow traffic such as DHCP if the DHCP server is on a different VLAN.

One parting note, that may seem obvious but I have seen trip people up before. If the SVI has multiple subnets associated with it, you need to make sure your ACLs take this into account as traffic that passes between these subnets will be processed by the ACL even though it stays within the VLAN.

As long as you keep the concept that the SVI is an interface, this should be easy to accomplish.

Improve this answer
1
  • 1
    Thank you for a thoroughly explained and understandable answer with examples. I am accepting this as the correct answer because it is more fully formed as a response.
    – skrap3e
    Jul 15, 2015 at 6:14
4

Think of all the ports in the vlan as being one port, traffic between them never hit the vlan-L3 interface.

Only traffic flowing between vlan's hit the vlan-32 ACL.

Thus traffic from vlan-X to vlan-32-host will be seen as outbound by the vlan-32 ACL.

And traffic from a host in vlan32, that hits the GW on it's way somewhere else will be inbound.

Improve this answer
4
  • This is what I was looking for, thank you very much!
    – skrap3e
    Jul 14, 2015 at 16:47
  • The first sentence in this answer is only correct if you only have a single subnet assigned to the VLAN/SVI. If there is a secondary IP range, then traffic between the subnets while staying within the VLAN will still traverse the SVI.
    – YLearn
    Jul 14, 2015 at 18:28
  • @Ylearn Would you consider that a "non standard" deployment? In my experience, multiple subnets on the same VLAN is more of a fringe case (or band-aid fix) than a common case.
    – Eddie
    Jul 14, 2015 at 18:52
  • Depends on the environment, but I would agree it is definitely in the minority and the majority of deployments tend to use a VLAN to subnet ratio of 1:1. Whether or not that is the case though doesn't make my comment any less true.
    – YLearn
    Jul 14, 2015 at 18:59
0

Imagine yourself as the router. "In" is traffic you receive; "out" is traffic you transmit.

ip access-group foo in applies to traffic received on an interface. ... out applies to traffic being transmit on an interface.

Improve this answer
6
  • yes I get that, but in this context the traffic that is coming from the VLAN 32 subnet, at the Layer 3 Switch where the traffic is being routed, is the traffic considered going "in" or "out" of the VLAN. What about traffic coming from VLAN 10 into VLAN 32, and vice-versa. I'll add another detail to my question that might make it more clear to answer.
    – skrap3e
    Jul 13, 2015 at 23:58
  • @lasersauce, you only come into or out from a physical device. Never think about into or out from a VLAN.
    – Ron Maupin ♦
    Jul 14, 2015 at 0:21
  • 1
    But the ACL can be applied to the VLAN interface (virtual interface yes) as IN or OUT. Surely there is a difference there? Thanks in advance, this has really been a roadblock for me mentally today.
    – skrap3e
    Jul 14, 2015 at 0:24
  • @lasersauce, the ACL is applied to a router interface (a VLAN interface is a router interface, albeit a virtual interface, but still a router interface), and the in or out is ALWAYS from the router's perspective. This is something many people have a hard time wrapping their heads around. Never, ever, think of it from anything but the perspective of the router itself. Pretend you are the router, and think about inhaling and exhaling. Your breath is from your perspective, not the perspective of the atmosphere, balloon, straw, or whatever else you are breathing from and to.
    – Ron Maupin ♦
    Jul 14, 2015 at 1:08
  • whether or not the in or out is from the router perspective i'm asking from the perspective of the vlan itself. traffic on subnet 32 being routed out of vlan 32 into another subnet or from another subnet on that same L3 switch into vlan 32. in those cases how is the traffic being seen ,respectively. the ACL is set for either in or out
    – skrap3e
    Jul 14, 2015 at 4:57
0

vlan32 has a virtual vlan interface, all traffic originating from vlan32 need to go out of this vlan will send traffic to vlan32's virtual interface, from the virtual interface perspective, these traffic are IN

traffic originating from other vlan like vlan 40 and need to go to vlan32, will need to use vlan32's interface as a relay, these traffic will go out of vlan32's virtual interface to go to vlan32, so these traffic from vlan32's interface perspective, they are OUT

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.