Cisco 4500M Software Manual page 509

Chapter 35 Configuring Network Security with ACLs
Using PACL with VLAN Maps and Router ACLs
Scenario 1: Host A is connected to an interface in VLAN 20, which has an SVI configured. The interface
has input PACL configured, and the SVI has input Router ACL configured as shown in Figure 35-7:
Figure 35-7 Scenario 1: PACL Interaction with an Input Router ACL
Catalyst 4500 series switch
Input
Input router Output
PACL ACL PACL
Frame
Host A Host B
(VLAN 10) (VLAN 20)
Routing function
VLAN 10 VLAN 20
Packet
If the interface access group mode is prefer port, then only the input PACL is applied on the ingress
traffic from Host A. If the mode is prefer vlan, then only the input Router ACL is applied to ingress
traffic from Host A that requires routing. If the mode is merge, then the input PACL is first applied to
the ingress traffic from Host A, and the input Router ACL is applied on the traffic that requires routing.
Scenario 2: Host A is connected to an interface in VLAN 10, which has a VACL (VLAN Map)
configured and an input PACL configured as shown in Figure 35-8:
Figure 35-8 Scenario 2: PACL Interaction with a VACL
Catalyst 4500 series switch
Input VLAN 10
PACL
map
Frame
Host A Host B
(VLAN 10) (VLAN 10)
Packet
VLAN 10
Software Configuration Guide—Release 12.2(25)EW
35-27
OL-6696-01