What is L3 and L2 interfaces in ACL feature

and why ethernet access-lists will not support L3 interfaces



The RACL is the access control list you're most likely to be familiar with. Typically, a Router ACL is just simply referred to as an ACL. The only time it's necessary to give extra designation is when we need to refer to the different types of ACLs available.

The Router ACL is simply an access list applied incoming or outgoing on an interface.

Switch(config)#ip access-list extended 100
Switch(config-ext-nacl)#permit ip any


A Vlan Access Control List, or VACL, is actually much more similar to a route-map than the typical Router ACL. You also would typically use an IP or MAC access-list in the match part of your VACL. Unlike a Router ACL, the VACL is not applied to the VLAN incoming or outgoing. Instead; it is applied without an in or out designation just like a route-map.

VACLs are processed in the ACL TCAM hardware. VACLs ignore any Cisco IOS ACL fields that are not supported in hardware.

The fact that traffic would come in one VLAN and then could go out another VLAN, is similar to the concept of applying ACLs inbound or outbound. The traffic would ingress on say VLAN1. The VACL applied to VLAN1 would apply. If the traffic is forwarded to another VLAN, say VLAN2, it would then be egress traffic on VLAN2.

Define MAC access list.

Switch(config)#mac access-list extended MACFilter
Switch(config-ext-macl)#permit 123.456.000 000.000.fff any

Define IP access list.
Switch(config)#ip access-list extended IPFilter
Switch(config-ext-nacl)#permit ip any

Create new access-map that matches access lists.
Switch(config)#vlan access-map DropSomeTraffic
Switch(config-access-map)#match ip address IPFilter
Switch(config-access-map)#match mac address MACFilter

The configuration up to this point creates two access lists and matches them. To set a drop or forward action use the action command. The command can be accompanied by drop, forward, or redirect.

Switch(config-access-map)#action drop

Finally, we need to apply the VACL to the vlan(s). This is done from global config mode.

Switch(config)#vlan filter DropSomeTraffic vlan-list 1,3,17-20


Port Access Control Lists, PACLs, are applied to as IP or MAC access lists. PACLs closely resemble a Router ACL. PACLs are applied to switch ports and can be specified for ingress or egress traffic. If a VACL and a PACL are both configured, the PACL is applied to ingress traffic first. If the traffic is permitted, it will then be subjected to the VACL.

Switch(config-if)#ip access-group PACLIPList in
Switch(config-if)#mac access-group PACLMACList in

If both a VACL and PACL are configured, some switches allow modification of how they interact with each other. By default, the two ACLs will be merged. The mode can also be modified so that the PACL takes precedence.

Switch(config-if)#access-group mode prefer merge <---Default
Switch(config-if)#access-group mode prefer port

If a port is changed to a layer 3 port with the no switchport command, the PACL remains in the configuration but is inactive. Changing the port back to layer 2 with the command switchport would cause the PACL to be active again.

When you create a port ACL, an entry is created in the ACL TCAM. You can use the show tcam counts command to see how much TCAM space is available.

Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/vacl.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.