Cisco Catalyst 250 Series User Manual

Restrictions for Configuring IPv4 Access Control Lists
General Network Security
The following are restrictions for configuring network security with ACLs:
•
Not all commands that accept a numbered ACL accept a named ACL. ACLs for packet filters and route
filters on interfaces can use a name. VLAN maps also accept a name.
•
A standard ACL and an extended ACL cannot have the same name.
•
Though visible in the command-line help strings, appletalk is not supported as a matching condition
for the deny and permit MAC access-list configuration mode commands.
•
ACL wildcard is not supported in downstream client policy.
IPv4 ACL Network Interfaces
The following restrictions apply to IPv4 ACLs to network interfaces:
•
When controlling access to an interface, you can use a named or numbered ACL.
•
If you apply an ACL to a Layer 2 interface that is a member of a VLAN, the Layer 2 (port) ACL takes
precedence over an input Layer 3 ACL applied to the VLAN interface or a VLAN map applied to the
VLAN.
•
If you apply an ACL to a Layer 3 interface and routing is not enabled on the switch, the ACL only filters
packets that are intended for the CPU, such as SNMP, Telnet, or web traffic.
•
You do not have to enable routing to apply ACLs to Layer 2 interfaces.
By default, the router sends Internet Control Message Protocol (ICMP) unreachable messages when a
packet is denied by an access group on a Layer 3 interface. These access-group denied packets are not
dropped in hardware but are bridged to the switch CPU so that it can generate the ICMP-unreachable
message. They do not generate ICMP unreachable messages. ICMP unreachable messages can be disabled
on router ACLs with the no ip unreachables interface command.
Note
MAC ACLs on a Layer 2 Interface
After you create a MAC ACL, you can apply it to a Layer 2 interface to filter non-IP traffic coming in that
interface. When you apply the MAC ACL, consider these guidelines:
•
You can apply no more than one IP access list and one MAC access list to the same Layer 2 interface.
The IP access list filters only IP packets, and the MAC access list filters non-IP packets.
•
A Layer 2 interface can have only one MAC access list. If you apply a MAC access list to a Layer 2
interface that has a MAC ACL configured, the new ACL replaces the previously configured one.
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
140 OL-29048-01
Configuring IPv4 ACLs
Restrictions for Configuring IPv4 Access Control Lists

Cisco Catalyst 250 Series Specifications

General

Brand	Cisco
Model	Catalyst 250 Series
Category	Switch
Language	English