I try to accept ACL on L3 switch inteface. I've created standard ACL via:

SW-L3(config)#access-list 1 permit host
SW-L3(config)#access-list 1 permit host

Then i tried to execute this, but there's no such command:

SW-L3(config)#int fa0/5
SW-L3(config-if)#ip access-group 
% Invalid input detected at '^' marker.

(I use packet tracker 7 if it's important)

So, what i'm doing wrong? Is it possible to deal with ACL on L3 switches?


I'm stuck with ACL again. My scheme is: enter image description here

L3 sh run:

interface Vlan1
ip address
interface Vlan10
mac-address 00d0.bca6.0e03
no ip address
interface Vlan111
mac-address 00d0.bca6.0e01
ip address
interface Vlan222
mac-address 00d0.bca6.0e02
ip address
ip classless
ip flow-export version 9
access-list 1 permit host

I'd like to have access to server only from ''. I have ACL :

access-list 1 permit host

on int fa0/5 IN. But it doesn't work. pkt file is here

  • try the command "no switchport" on the interface before applying the ACL.
    – Ron Trunk
    Oct 18, 2016 at 11:16
  • @RonTrunk thanks, it works! Write this below and i'll mark it as an answer. Oct 18, 2016 at 11:17

1 Answer 1


By default, interfaces on Cicso L3 switches are layer 2, so you would have to apply the ACLto the SVI (VLAN interface). In order to make the interface a layer 3 interface use the command

no switchport

EDIT: I can't tell which interface is Fa0/5, but I also notice you haven't applied the ACL to any interface.

if you want to use a standard ACL, you can apply ACL 1 on VLAN outbound:

Interface VLAN 1
ip access-group 1 out

A better way is to use an extended ACL on the inbound interface:

access-list 100 permit ip host  host
interface VLAN 1
ip access-group 100 in
  • What about L2 switch, how can i apply ACL on some interface? "no switchport" doesn't work Oct 18, 2016 at 14:19
  • L2 switches only operate at L2, so they don't read inside the ethernet frame. They don't understand IP addressing, so an ACL doesn't make sense. You can apply it on the VLAN interface, since that is L3.
    – Ron Trunk
    Oct 18, 2016 at 14:21
  • I've added my problem above. Oct 18, 2016 at 14:41
  • @nameerror I've expanded my answer based on your diagram.
    – Ron Trunk
    Oct 18, 2016 at 14:51
  • Huh, thanks a lot! Only in the last string will be "access-group 100 in", but it doesn't matter, i got it! Oct 18, 2016 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.