Reflexive ACLs on SVIs

[jason.henderson]

I can configure a RACL on a physical interface, but it doesn't work on an SVI. Can anyone explain why it doesn't work?

[Giuseppe Larosa]

Hello Jason,

I suppose you are using an ISR router with an etherswitch module.

the reflexive ACL is a "router" security feature and so it can be applied to a "router" interface.

Besides this, an SVI can receive traffic from L2 ports associated with the broadcast domain and from other L3 devices so it is a less clear context.

Hope to help

Giuseppe