About VLAN ACLs
A VLAN ACL (VACL) is one application of an IP ACL or a MAC ACL. You can configure VACLs to apply to all packets that are routed into or out of a VLAN or are bridged within a VLAN. VACLs are strictly for security packet filtering and for redirecting traffic to specific physical interfaces. VACLs are not defined by direction (ingress or egress).
VLAN Access Maps and Entries
VACLs use access maps to contain an ordered list of one or more map entries. Each map entry associates IP or MAC ACLs to an action. Each entry has a sequence number, which allows you to control the precedence of entries.
When the device applies a VACL to a packet, it applies the action that is configured in the first access map entry that contains an ACL that permits the packet.
VACLs and Actions
In access map configuration mode, you use the action command to specify one of the following actions:
Sends the traffic to the destination determined by the normal operation of the device.
Redirects the traffic to one or more specified interfaces.
Drops the traffic. If you specify drop as the action, you can also specify that the device logs the dropped packets.
The device can maintain global statistics for each rule in a VACL. If a VACL is applied to multiple VLANs, the maintained rule statistics are the sum of packet matches (hits) on all the interfaces on which that VACL is applied.
The device does not support interface-level VACL statistics.
For each VLAN access map that you configure, you can specify whether the device maintains statistics for that VACL. This feature allows you to turn VACL statistics on or off as needed to monitor traffic filtered by a VACL or to help troubleshoot VLAN access-map configuration.
Session Manager Support for VACLs
Session Manager supports the configuration of VACLs. This feature allows you to verify the ACL configuration and confirm that the resources required by the configuration are available prior to committing them to the running configuration. For more information about Session Manager, see the Cisco Nexus 9000 Series NX-OS System Management Configuration Guide.