Connectivity Guide

L2 and L3 ACLs
Configure both L2 and L3 ACLs on an interface in L2 mode. Rules apply if you use both L2 and L3 ACLs on an interface.
● L3 ACL filters packets and then the L2 ACL filters packets
● Egress L3 ACL filters packets
Rules apply in order:
● Ingress L3 ACL
● Ingress L2 ACL
● Egress L3 ACL
● Egress L2 ACL
NOTE: In ingress ACLs, L2 has a higher priority than L3 and in egress ACLs, L3 has a higher priority than L2.
Table 58. L2 and L3 targeted traffic
L2 ACL / L3 ACL Targeted traffic
Deny / Deny L3 ACL denies
Deny / Permit L3 ACL permits
Permit / Deny L3 ACL denies
Permit / Permit L3 ACL permits
Assign and apply ACL filters
To filter an Ethernet interface, a port-channel interface, or a VLAN, assign an IP ACL filter to a physical interface. The IP ACL
applies to all traffic entering a physical or port-channel interface. The traffic either forwards or drops depending on the criteria
and actions you configure in the ACL filter.
To change the ACL filter functionality, apply the same ACL filters to different interfaces. For example, take ACL “ABCD” and
apply it using the in keyword and it becomes an ingress ACL. If you apply the same ACL filter using the out keyword, it
becomes an egress ACL.
You can apply an IP ACL filter to a physical or port-channel interface. The number of ACL filters allowed is hardware-dependent.
1. Enter the interface information in CONFIGURATION mode.
interface ethernet node/slot/port
2. Configure an IP address for the interface, placing it in L3 mode in INTERFACE mode.
ip address ip-address
3. Apply an IP ACL filter to traffic entering or exiting an interface in INTERFACE mode.
ip access-group access-list-name {in | out}
Configure IP ACL
OS10(config)# interface ethernet 1/1/28
OS10(conf-if-eth1/1/28)# ip address 10.1.2.0/24
OS10(conf-if-eth1/1/28)# ip access-group abcd in
View ACL filters applied to interface
OS10# show ip access-lists in
Ingress IP access-list acl1
Active on interfaces :
ethernet1/1/28
seq 10 permit ip host 10.1.1.1 host 100.1.1.1 count (0 packets)
seq 20 deny ip host 20.1.1.1 host 200.1.1.1 count (0 packets)
seq 30 permit ip 10.1.2.0/24 100.1.2.0/24 count (0 packets)
Access Control Lists
845