1

I try to accept ACL on L3 switch inteface. I've created standard ACL via:

SW-L3(config)#access-list 1 permit host 1.1.1.2
SW-L3(config)#access-list 1 permit host 1.1.1.3

Then i tried to execute this, but there's no such command:

SW-L3(config)#int fa0/5
SW-L3(config-if)#ip access-group 
                 ^
% Invalid input detected at '^' marker.

(I use packet tracker 7 if it's important)

So, what i'm doing wrong? Is it possible to deal with ACL on L3 switches?

#

I'm stuck with ACL again. My scheme is: enter image description here

L3 sh run:

interface Vlan1
ip address 192.168.10.1 255.255.255.0
interface Vlan10
mac-address 00d0.bca6.0e03
no ip address
interface Vlan111
mac-address 00d0.bca6.0e01
ip address 1.1.1.1 255.255.255.0
interface Vlan222
mac-address 00d0.bca6.0e02
ip address 2.2.2.1 255.255.255.0
ip classless
ip flow-export version 9
access-list 1 permit host 2.2.2.2

I'd like to have access to server only from '2.2.2.2'. I have ACL :

access-list 1 permit host 2.2.2.2

on int fa0/5 IN. But it doesn't work. pkt file is here

2
  • try the command "no switchport" on the interface before applying the ACL.
    – Ron Trunk
    Oct 18 '16 at 11:16
  • @RonTrunk thanks, it works! Write this below and i'll mark it as an answer.
    – NameError
    Oct 18 '16 at 11:17
2

By default, interfaces on Cicso L3 switches are layer 2, so you would have to apply the ACLto the SVI (VLAN interface). In order to make the interface a layer 3 interface use the command

no switchport

EDIT: I can't tell which interface is Fa0/5, but I also notice you haven't applied the ACL to any interface.

if you want to use a standard ACL, you can apply ACL 1 on VLAN outbound:

Interface VLAN 1
ip access-group 1 out

A better way is to use an extended ACL on the inbound interface:

access-list 100 permit ip host 192.168.10.2  host 2.2.2.2
interface VLAN 1
ip access-group 100 in
6
  • What about L2 switch, how can i apply ACL on some interface? "no switchport" doesn't work
    – NameError
    Oct 18 '16 at 14:19
  • L2 switches only operate at L2, so they don't read inside the ethernet frame. They don't understand IP addressing, so an ACL doesn't make sense. You can apply it on the VLAN interface, since that is L3.
    – Ron Trunk
    Oct 18 '16 at 14:21
  • I've added my problem above.
    – NameError
    Oct 18 '16 at 14:41
  • @nameerror I've expanded my answer based on your diagram.
    – Ron Trunk
    Oct 18 '16 at 14:51
  • Huh, thanks a lot! Only in the last string will be "access-group 100 in", but it doesn't matter, i got it!
    – NameError
    Oct 18 '16 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.