Switch does look at layer 2 information - Ethernet payload, L3 switch look at IP payload too, if need.

And the question is: How feature like this "ip access-list extended tcp deny host any eq http" work? Switch start look at all L4 payload?

  • It depends on what type of switch you are talking about. There are switches that operate at layer 2, but have a TCAM ASIC that is capable to look up to IP/TCP layer and filter based on that. So you can apply ip access-list even on a layer 2 switch. But again it all depends on the switch type.
    – user36472
    Oct 5, 2018 at 5:43
  • Can you take an example of Cisco catalyst model? What switch start to do when I create extended ACL with tcp/udp ports and apply it on an interface? Oct 5, 2018 at 6:03
  • I was able to set that kind of ACL on Cisco 2960 Oct 5, 2018 at 6:07
  • All Cisco Catalyst switches have TCAM ASIC's.
    – user36472
    Oct 5, 2018 at 6:20
  • ok, switch continue to look at l2 and l3 only, but ip acess-list work through tcam asic magic? =) Oct 5, 2018 at 6:38

1 Answer 1


Adding an entry (ACE) to an ACL adds a corresponding entry to the TCAM table that is being applied to the frames/packets passing through the configured port or VLAN.

A ternary CAM doesn't require a complete match like a simple CAM. Instead, wildcard bits can be set to mask/ignore. Your ip access-list extended tcp deny host any eq http would translate to something along (TCAM hex on left, readable form on right side)

value    mask     
0800     0000      Ethertype=IPv4
4        0         IP version=4/0
01020304 00000000  IP source address=
00000000 FFFFFFFF  IP destination address= (any)
06       00        L4 protocol=6/0 (TCP)
0000     FFFF      L4 source port=0/65535 (any)
0080     0000      L4 destination port=80/0

The / indicating the wildcard bits - 0 means full match, 255 or 65535 or '' mean "doesn't matter at all "for byte or 16-bit or 32-bit values. The TCAM can also do partial matches for addresses like for the subnet.

In the switch, each packet is presented to all TCAM-stored ACEs of an ACL at the same time. The first ACE that matches gives its action as result (permit/deny) and the action is carried out. Since there's an implicit deny any any at the end of the ACL there's always a match.

The L4 (here: TCP) payload isn't checked, only the headers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.