What is L3 and L2 interfaces in ACL feature
and why ethernet access-lists will not support L3 interfaces
The RACL is the access control list you're most likely to be familiar with. Typically, a Router ACL is just simply referred to as an ACL. The only time it's necessary to give extra designation is when we need to refer to the different types of ACLs available.
The Router ACL is simply an access list applied incoming or outgoing on an interface.
Switch(config)#ip access-list extended 100 Switch(config-ext-nacl)#permit ip any 192.168.1.0 0.0.0.255
A Vlan Access Control List, or VACL, is actually much more similar to a route-map than the typical Router ACL. You also would typically use an IP or MAC access-list in the match part of your VACL. Unlike a Router ACL, the VACL is not applied to the VLAN incoming or outgoing. Instead; it is applied without an in or out designation just like a route-map.
VACLs are processed in the ACL TCAM hardware. VACLs ignore any Cisco IOS ACL fields that are not supported in hardware.
The fact that traffic would come in one VLAN and then could go out another VLAN, is similar to the concept of applying ACLs inbound or outbound. The traffic would ingress on say VLAN1. The VACL applied to VLAN1 would apply. If the traffic is forwarded to another VLAN, say VLAN2, it would then be egress traffic on VLAN2.
Define MAC access list.
Switch(config)#mac access-list extended MACFilter Switch(config-ext-macl)#permit 123.456.000 000.000.fff any Define IP access list. Switch(config)#ip access-list extended IPFilter Switch(config-ext-nacl)#permit ip any 192.168.1.0 0.0.0.255 Create new access-map that matches access lists. Switch(config)#vlan access-map DropSomeTraffic Switch(config-access-map)#match ip address IPFilter Switch(config-access-map)#match mac address MACFilter
The configuration up to this point creates two access lists and matches them. To set a drop or forward action use the action command. The command can be accompanied by drop, forward, or redirect.
Finally, we need to apply the VACL to the vlan(s). This is done from global config mode.
Switch(config)#vlan filter DropSomeTraffic vlan-list 1,3,17-20
Port Access Control Lists, PACLs, are applied to as IP or MAC access lists. PACLs closely resemble a Router ACL. PACLs are applied to switch ports and can be specified for ingress or egress traffic. If a VACL and a PACL are both configured, the PACL is applied to ingress traffic first. If the traffic is permitted, it will then be subjected to the VACL.
Switch(config-if)#ip access-group PACLIPList in Switch(config-if)#mac access-group PACLMACList in
If both a VACL and PACL are configured, some switches allow modification of how they interact with each other. By default, the two ACLs will be merged. The mode can also be modified so that the PACL takes precedence.
Switch(config-if)#access-group mode prefer merge <---Default Switch(config-if)#access-group mode prefer port
If a port is changed to a layer 3 port with the no switchport command, the PACL remains in the configuration but is inactive. Changing the port back to layer 2 with the command switchport would cause the PACL to be active again.
When you create a port ACL, an entry is created in the ACL TCAM. You can use the
show tcam counts command to see how much TCAM space is available.