VLAN Security - VLAN Access Control List's (VACL)

December 10, 2014 3-minute read

I’ve been studying to renew my CCNP as of recently, and I decided to create a refresher blog post about the implementation of VACLs.

VLAN Access Control Lists (VACLs) can be used to implement Access Control at both Layer 2 and Layer 3. Typically, access lists are applied to ingress or egress traffic on a routed, L3 interface. VACL’s allow you to apply the filtering to all packets, regardless of direction.

VACL’s are created and applied in a similar manner to route-maps and policy-based routing, in the sense that you create a VLAN access-map, and then apply the VLAN access-maps to VLAN’s with a filter statement. Lets see an example.

I have pre-created VLAN 123 with an L3 interface address of 10.123.123.1/24. I have joined a port to this VLAN, and connected a PC with an IP address of 10.123.123.124/24.

IP-based VACL

For a Layer 3, IP-based VACL, we must first create a regular ACL. This ACL will either contain IP’s to permit, or IP’s to block. Remember that by default, an implicit ‘deny all’ is in place, so unless you explicitly allow, the packets will be denied. The implicit ‘deny all’ can be counteracted with an explicit ‘allow all’ at the tail end of the ACL. In this case, only specifically denied traffic will be denied.

Create the Access List ** vacl_1 **

Create the VLAN Access Map vacl_2

Confirm the VLAN Access Map Configuration vacl_4

Apply the the VLAN Access Map to specified VLAN(s)

Confirm the Application of the VLAN Access Map vacl_5

Lets test the configuration. We have specifically allowed only 10.123.123.123 to be able to communicate on the VLAN.

With the IP address set to 10.123.123.123/24, we can successfully ping the L3 interface of the VLAN. vacl_6

With the IP address set to 10.123.123.124/24, we cannot. vacl_7

We now have a functional implementation of a Layer 3 VLAN Access Control List! Now, lets delve into how similar functionality can be achieved at Layer 2.

MAC-based VACL

Layer 2 filtering simply involves substituting MAC Access Control Lists for IP Access Control Lists. MAC ACL’s are very similar to IP ACL’s, and extended MAC ACL’s can even make use of wildcard masks. Wildcard masks might be used if you wanted to restrict traffic to a certain vendor’s MAC OUI. Under typical circumstances, the first 24 bits of a MAC address are known as an Organizationally Unique Identifier, and are assigned to vendors by the IEEE under ISO/IEC 8802 standards. Anyway, on to the example.

First, clear out the existing VLAN access map with a no vlan access-map FILTER_NAME.

We need to make a MAC ACL. In this case, I am specifically denying my laptop’s MAC address. I have blurted out part of the MAC for security purposes. I didn’t, but you’d probably want to add an allow any any statement if you only want to block specific MAC addresses.

Create the MAC Access Control List vacl_8