cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
437
Views
0
Helpful
1
Replies

VACL {meaning of permit | deny} ?

philipbarker
Level 1
Level 1

Hi,

The following snippet is taken from the following link:

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/122sx/swcg/vacl.pdf

"When a flow matches a permit ACL entry,

the associated action is taken and the flow is not checked against the remaining sequences. When a flow

matches a deny ACL entry, it will be checked against the next ACL in the same sequence or the next sequence."

I am not convinced about the above statement:

If I create the following vacl

vlan access-map block-aspire 10

action drop

match ip address ipexpert

vlan access-map block-aspire 20

action forward

vlan filter block-aspire vlan-list 55

ip access-list extended ipexpert

permit ip host 172.16.1.254 host 172.16.1.253

Here, I have a 'permit' access-list entry and the action performed is to successfully drop packets between the hosts 172.16.1.254 and 172.16.1.253 and to forward other packets for vlan 55.

If I change seq no 20 to 'drop' then I can see that this action is being taken since no hosts in vlan 55 can ping each other.

This appears contrary to the cisco link.

Can someone please verify ?

PS: I am using 2x3550's not 6500's as in the Cisco link.

Regards,

Phil.

1 Reply 1

Edison Ortiz
Hall of Fame
Hall of Fame

The document says:

When a flow matches a deny ACL entry

and you did:

I change seq no 20 to 'drop'

You didn't create a deny ACL entry as the document states.

__

Edison.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco