Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

"Normal" ACLs are applied either inbound or outbound on an interface. However, I've come across a Cisco 6500 series layer 3 switch that uses VLAN access maps to filter traffic within its VLANs. It has two access maps configured, one for forwarding traffic, and one for dropping traffic.

What I would like to know is when during routing/switching are these access maps applied? Are they inbound on any affected VLAN port, outbound, or some other time entirely?

EDIT: Perhaps I was unclear. I understand how to apply the access-map and the commands required; I am asking about when, within the switching logic of the device, are these decisions applied to packets (or perhaps frames is a better term). From one answer below, it seems that the drop/forward decision is taken inbound on any port assigned to the VLAN in question. Is this correct?

share|improve this question

If you use a vlan filter command to apply an access-map to a vlan N all Layer 2 and Layer 3 traffic will be filtered by the access-map when entering the vlan N.
I recommand you to read for a very complete information of how vlan ACL works.

share|improve this answer
So when is it correct to say a packet entered a VLAN? Upon entering an access port defined as a member of a particular VLAN and/or when a packet gets switched internally to a VLAN-defined access port? Both? Neither? – romandas Sep 15 '09 at 13:21
Both, it enter either directly or by beeing switched to. It's Figure 35-2 on the link I provided – radius Sep 15 '09 at 14:42

Usually you need to bind maps/ACLs to an interface. In your case (L3-Switch), this interface should be a VLAN-pseudo-interface (conf t -> int vlan 111) rather than an actual ethernet port.

Could you paste the relevant part of the config?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.