VLAN Access-List (VACL)

VLAN access lists (VACL) are very useful to filter traffic within the VLAN. Let me give you an example:

Let’s say I want to make sure that the two computers cannot communicate with the server. You could use port-security to filter MAC addresses, but this isn’t a very safe method.

I will show you how to configure a VACL so that the two computers won’t be able to reach the server. First, we have to create an access-list:

SW1(config)#access-list 100 permit ip any host 192.168.1.100

The first step is to create an extended access-list. Traffic from any source to destination IP address 192.168.1.100 should match my access-list. This might look confusing to you because your gut will tell you to use “deny” in this statement…don’t do it, though, use the permit statement! Now we can create a VLAN access map:

SW1(config)#vlan access-map NOT-TO-SERVER 10
SW1(config-access-map)#match ip address 100
SW1(config-access-map)#action drop
SW1(config-access-map)#vlan access-map NOT-TO-SERVER 20
SW1(config-access-map)#action forward

My VLAN access map is called “NOT-TO-SERVER”. This is what it does:

• Sequence number 10 will look for traffic that matches access-list 100. All traffic that is permitted in access-list 100 will match here. The action is to drop this traffic.
• Sequence number 20 doesn’t have a match statement, so everything will match. The action is to forward traffic.

As a result, all traffic from any host to the destination IP address 192.168.1.100 will be dropped, and everything else will be forwarded. Let’s enable it:

SW1(config)#vlan filter NOT-TO-SERVER vlan-list 10

The last step is to apply the VACL to the VLANs you want. I use mine for VLAN 10. Let’s see if this works or not. The hosts and the server in my lab are routers running Cisco IOS XE 17.12, and SW1 runs IOS XE 17.15 (IOL):