1

I try to accept ACL on L3 switch inteface. I've created standard ACL via:

SW-L3(config)#access-list 1 permit host 1.1.1.2
SW-L3(config)#access-list 1 permit host 1.1.1.3

Then i tried to execute this, but there's no such command:

SW-L3(config)#int fa0/5
SW-L3(config-if)#ip access-group 
                 ^
% Invalid input detected at '^' marker.

(I use packet tracker 7 if it's important)

So, what i'm doing wrong? Is it possible to deal with ACL on L3 switches?

#

I'm stuck with ACL again. My scheme is: enter image description here

L3 sh run:

interface Vlan1
ip address 192.168.10.1 255.255.255.0
interface Vlan10
mac-address 00d0.bca6.0e03
no ip address
interface Vlan111
mac-address 00d0.bca6.0e01
ip address 1.1.1.1 255.255.255.0
interface Vlan222
mac-address 00d0.bca6.0e02
ip address 2.2.2.1 255.255.255.0
ip classless
ip flow-export version 9
access-list 1 permit host 2.2.2.2

I'd like to have access to server only from '2.2.2.2'. I have ACL :

access-list 1 permit host 2.2.2.2

on int fa0/5 IN. But it doesn't work. pkt file is here

Improve this question
2
  • try the command "no switchport" on the interface before applying the ACL.
    – Ron Trunk
    Commented Oct 18, 2016 at 11:16
  • @RonTrunk thanks, it works! Write this below and i'll mark it as an answer.
    – Daniil Rutskiy
    Commented Oct 18, 2016 at 11:17

1 Answer 1

Reset to default
2

By default, interfaces on Cicso L3 switches are layer 2, so you would have to apply the ACLto the SVI (VLAN interface). In order to make the interface a layer 3 interface use the command 

no switchport

EDIT: I can't tell which interface is Fa0/5, but I also notice you haven't applied the ACL to any interface.

if you want to use a standard ACL, you can apply ACL 1 on VLAN outbound:

Interface VLAN 1
ip access-group 1 out

A better way is to use an extended ACL on the inbound interface:

access-list 100 permit ip host 192.168.10.2  host 2.2.2.2
interface VLAN 1
ip access-group 100 in
Improve this answer
6
  • What about L2 switch, how can i apply ACL on some interface? "no switchport" doesn't work
    – Daniil Rutskiy
    Commented Oct 18, 2016 at 14:19
  • L2 switches only operate at L2, so they don't read inside the ethernet frame. They don't understand IP addressing, so an ACL doesn't make sense. You can apply it on the VLAN interface, since that is L3.
    – Ron Trunk
    Commented Oct 18, 2016 at 14:21
  • I've added my problem above.
    – Daniil Rutskiy
    Commented Oct 18, 2016 at 14:41
  • @nameerror I've expanded my answer based on your diagram.
    – Ron Trunk
    Commented Oct 18, 2016 at 14:51
  • Huh, thanks a lot! Only in the last string will be "access-group 100 in", but it doesn't matter, i got it!
    – Daniil Rutskiy
    Commented Oct 18, 2016 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.