0

I'm trying to understand Cisco Switch ACL options I can potentially use to limit traffic. Switch is a IE2000 series with Lanbase IOS. It is L2, with trunk port to uplink switches, multiple VLANs on switch, but L3/vlan routing is handled by a L3 switch up the chain.

What I want to do - there is a device on one physical port that is faulting, seemingly due to to much network traffic (device does not fault when uplink on switch is unplugged & there are at least 100 devices on the VLAN) - as a stop gap until we can do some better network engineering, is limit access to the device to the 2-3 ip addresses that actually need to talk to the device. If I could put an ACL on the switchport to limit traffic sent to the device, it would have been perfect, but as far as I can tell, Cisco only allows inbound ACLs on a switch port (unless I am misunderstanding what Cisco calls inbound and outbound).

Looks like I may be able to put a inbound ACL on the physical port used for the trunk - but that would affect all VLANs? Also, I would need understand traffic for rest of devices on switch & to check if we were using Etherchannel on that port as I am sure that may complicate things.

However, it looks like Cisco allows ACLs on VLANs, and I need to wrap my head around how that would work. I comprehend how ACLs would work on the L3 switch doing routed. For the L2 - can I just create a SVI for the VLAN without an ip address, and then put on inbound ACL on the VLAN SVI to limit traffic before it goes to physical ports for that VLAN?

Ex: External <-> Trunk Port(s) <-> {ACL???} <-> VLAN# SVI <-> Phys. Ports on VLAN#

Thanks, JT

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Dec 17, 2020 at 20:49

1 Answer 1

Reset to default
2

No, an ACL applied on an SVI will only affect traffic routed through that SVI. The traffic of interest is layer-2 switched through the access switch, and simply creating an SVI doesn't change that.

If you are able to reconfigure the malfunctioning device onto a new subnet, you could create an entirely new subnet using an SVI, put the device into the subnet, and then a related ACL would work.

However, it sounds like you're trying to find the least-invasive way to mitigate your problem temporarily. I don't know if the above is practical in your environment. A layer-3 ACL on the upstream gateway would seem more appropriate, if you're able to configure it there.

Improve this answer
1
  • 1
    Thanks. Its factory machinery that runs almost 24/7 and changing ip addresses is not trivial. Long term would be to give the machine its own subnet for just its 3-4 ip addresses and I think that would solve the problem by itself, but machine's gotta run in the meantime...
    – J T
    Aug 26, 2020 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.