A VLAN ACL (VACL) is one application of an IP ACL or a MAC ACL. You can configure VACLs to apply to all packets that are routed into or out of a VLAN or are bridged within a VLAN. VACLs are strictly for security packet filtering and for redirecting traffic to specific physical interfaces. VACLs are not defined by direction (ingress or egress).
VACLs use access maps to contain an ordered list of one or more map entries. Each map entry associates IP or MAC ACLs to an action. Each entry has a sequence number, which allows you to control the precedence of entries.
When the device applies a VACL to a packet, it applies the action that is configured in the first access map entry that contains an ACL that permits the packet.
VACLs and Actions
In access map configuration mode, you use the action command to specify one of the following actions:
Sends the traffic to the destination determined by the normal operation of the switch.
Redirects the traffic to one or more specified interfaces.
Drops the traffic. If you specify drop as the action, you can also specify that the device logs the dropped packets.
The device can maintain global statistics for each rule in a VACL. If a VACL is applied to multiple VLANs, the maintained rule statistics are the sum of packet matches (hits) on all the interfaces on which that VACL is applied.
The device does not support interface-level VACL statistics.
For each VLAN access map that you configure, you can specify whether the device maintains statistics for that VACL. This feature allows you to turn VACL statistics on or off as needed to monitor traffic filtered by a VACL or to help troubleshoot VLAN access-map configuration.
Session Manager Support for VACLs
Session Manager supports the configuration of VACLs. This feature allows you to verify ACL configuration and confirm that the resources required by the configuration are available prior to committing them to the running configuration. For more information about Session Manager, see the Cisco Nexus 7000 Series NX-OS System Management Configuration Guide.
Virtualization Support for VACLs
The following information applies to VACLs used in virtual device contexts (VDCs):
ACLs are unique per VDC. You cannot use an ACL that you created in one VDC in a different VDC.
Because ACLs are not shared by VDCs, you can reuse ACL names in different VDCs.
The device does not limit ACLs or rules on a per-VDC basis.
Licensing Requirements for VACLs
This table shows the licensing requirements for this feature.
VACLs require no license. However to support up to 128K ACL entries using an XL line card, you must install the scalable services license. Any feature not included in a license package is bundled with the Cisco NX-OS system images and is provided at no extra charge to you. For an explanation of the Cisco NX-OS licensing scheme, see the Cisco NX-OS Licensing Guide.
Prerequisites for VACLs
VACLs have the following prerequisite:
Ensure that the IP ACL or MAC ACL that you want to use in the VACL exists and is configured to filter traffic in the manner that you need for this application.
Guidelines and Limitations for VACLs
VACLs have the following configuration guidelines:
We recommend that you perform ACL configurations using the Session Manager. This feature allows you to verify ACL configuration and confirm that the resources required by the configuration are available prior to committing them to the running configuration. For more information about Session Manager, see the Cisco Nexus 7000 Series NX-OS System Management Configuration Guide.
ACL statistics are not supported if the DHCP snooping feature is enabled.
The maximum number of supported VACL entries is 64,000 for devices without an XL line card and 128,000 for devices with an XL line card.
If you try to apply too many ACL entries to a non-XL line card, the configuration is rejected.
Each forwarding engine on an F1 Series module supports 1000 ingress ACL entries, with 984 entries available for user configuration. The total number of VACL entries for the F1 Series modules is from 1000 to 16,000, depending on which forwarding engines the policies are applied.
F1 Series modules do not support ACL logging.
F1 Series modules do not support bank chaining.
Each VACL can support up to six different Layer 4 operations for F1 Series modules.
If the same ACL is applied on multiple VLANs of the same port for F1 Series modules (for example, VLAN 10, 20), it is programmed multiple times (in this case, on VLAN 10 and VLAN 20).
VACL redirects to SPAN destination ports are not supported.
Default Settings for VACLs
This table lists the default settings for VACL parameters.
You can create a VACL or add entries to an existing VACL. In both cases, you create a VACL entry, which is a VLAN access-map entry that associates one or more ACLs with an action to be applied to the matching traffic.
Before You Begin
Ensure that the ACLs that you want to use in the VACL exists and are configured to filter traffic in the manner that you need for this application.
Copies the running configuration to the startup configuration.
Removing a VACL or a VACL Entry
You can remove a VACL, which means that you will delete the VLAN access map.
You can also remove a single VLAN access-map entry from a VACL.
Before You Begin
Ensure that you know whether the VACL is applied to a VLAN. The device allows you to remove VACLs that are currently applied. Removing a VACL does not affect the configuration of VLANs where you have applied the VACL. Instead, the device considers the removed VACL to be empty.
2.no vlan access-map map-name [sequence-number]
3. (Optional) show running-config aclmgr
4. (Optional) copy running-config startup-config
Command or Action
switch# configure terminal
Enters global configuration mode.
no vlan access-map map-name [sequence-number]
switch(config)# no vlan access-map acl-mac-map 10
Removes the VLAN access map configuration for the specified access map. If you specify the sequence-number argument and the VACL contains more than one entry, the command removes only the entry specified.
Copies the running configuration to the startup configuration.
Verifying the VACL Configuration
To display VACL configuration information, perform one of the following tasks. For detailed information about the fields in the output from these commands, see the Cisco Nexus 7000 Series NX-OS Security Command Reference.
show running-config aclmgr [all]
Displays the ACL configuration, including the VACL-related configuration.
Beginning with Cisco NX-OS Release 5.2, this command displays the user-configured ACLs in the running configuration. The all option displays both the default (CoPP-configured) and user-configured ACLs in the running configuration.
show startup-config aclmgr [all]
Displays the ACL startup configuration.
Beginning with Cisco NX-OS Release 5.2, this command displays the user-configured ACLs in the startup configuration. The all option displays both the default (CoPP-configured) and user-configured ACLs in the startup configuration.
show vlan filter
Displays information about VACLs that are applied to a VLAN.
show vlan access-map
Displays information about VLAN access maps.
Monitoring and Clearing VACL Statistics
To monitor or clear VACL statistics, use one of the commands in this table. For detailed information about these commands, see the Cisco Nexus 7000 Series NX-OS Security Command Reference.
show vlan access-list
Displays the VACL configuration. If the VLAN access-map includes the statistics per-entry command, the show vlan access-list command output includes the number of packets that have matched each rule.
clear vlan access-list counters
Clears statistics for all VACLs or for a specific VACL.
Configuration Example for VACLs
The following example shows how to configure a VACL to forward traffic permitted by a MAC ACL named acl-mac-01 and how to apply the VACL to VLANs 50 through 82.
vlan access-map acl-mac-map
match mac address acl-mac-01
vlan filter acl-mac-map vlan-list 50-82
Cisco Nexus 7000 Series NX-OS Security Command Reference
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
Feature History for VLAN ACLs
This table lists the release history for this feature.
Table 2 Feature History for VLAN ACLs
Changed the show running-config aclmgr and show startup-config aclmgr commands to display only the user-configured ACLs (and not also the default CoPP-configured ACLs) in the running and startup configurations.
No change from Release 5.0.
Added support for up to 128,000 ACL entries when using an XL line card, provided a scalable services license is installed.