IP access list and service-policy are attached to vlan interface, or bvi interface? I think bvi is correct, because only this one is L3 interface. I'm sure?

Hi,

No, you should configure your ACLs and service-policies on the VLAN interfaces, not the BVI.

You should follow the traffic flow:

It is send by the upstream router into a particular VLAN (client-side) towards the VIP address (which is located inside the client-side VLAN and is reachable via the VLAN interface on the ACE). That is where you need to put your ACLs and service-policies.

Same way for the return traffic, it enters the ACE via the VLAN interface.

HTH,

Dario

Dario,

thanks for explanation.

on the bvi interface are configured only ip address, peer ip address aj alias address (for vip) without any access-group. right?

martin

Yes, that's correct.

If you have a redundant setup, don't forget to allow the Spanning-tree BPDUs!

Create an ACL that permits BPDUs and configure it on the both ACEs on the client- and serverside:

access-list NONIP ethertype permit bdpu

int vlan 10 ! client-side

access-group input NONIP

int vlan 20 ! server-side

access-group input NONIP

more info:

http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A2/configuration/rtg_brdg/guide/bridge.html#wp1174530

Please rate if this was useful for you.

Kind regards,

Dario