Solved: Are the ACLs in Cat3560 statefull or stateless?

alexandrfedchenko · ‎08-01-2010

Hello

Are the ACLs in Catalyst 3560 works like stateful or stateless firewall in latest software version?

Jon Marshall · ‎08-02-2010

alexandrfedchenko wrote:

Hello

Are the ACLs in Catalyst 3560 works like stateful or stateless firewall in latest software version?

Alexandr

Standard and extended acls on all devices are stateless ie. they check each packet in isolation. You can use the keyword "established" in an extended acl for TCP connections to check the syn/ack in the packets and you can use reflexive access-lists which are a little more stateful although i'm not sure the 3560 supports reflexive acls.

Jon

View solution in original post

CSCO11584685 · ‎08-02-2010

AFAIK if you use reflexive ACL then it is statefull, if you use the normal ACL then it would be stateless.

Jon Marshall · ‎08-02-2010

alexandrfedchenko wrote:

Hello

Are the ACLs in Catalyst 3560 works like stateful or stateless firewall in latest software version?

Alexandr

Standard and extended acls on all devices are stateless ie. they check each packet in isolation. You can use the keyword "established" in an extended acl for TCP connections to check the syn/ack in the packets and you can use reflexive access-lists which are a little more stateful although i'm not sure the 3560 supports reflexive acls.

Jon

alexandrfedchenko · ‎08-02-2010

i'm not sure the 3560 supports reflexive acls

No, it isn't.

The switch does not support these Cisco IOS router ACL-related features:

•Non-IP protocol ACLs (see Table 34-1) or bridge-group ACLs

•IP accounting

•Inbound and outbound rate limiting (except with QoS ACLs)

•Reflexive ACLs or dynamic ACLs (except for some specialized dynamic ACLs used by the switch clustering feature)

•ACL logging for port ACLs and VLAN maps

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_52_se/configuration/guide/swacl.html

Many thanks to all.