Both control-plane and data-plane Access Control Lists (ACLs) are supported on the WS-X4232-L3 module.
Control-plane ACLs: ACLs used to access control data that is processed by the CPU of the WS-X4232-L3 module (for example, distribution of routing information, IGMP joins, IPX SAPs and GNS packets, and so on)
Data-plane ACLs: ACLs used to access control user data being routed through the WS-X4232-L3 in hardware (for example, denying TCP sessions between two hosts, controlling access to devices in an IPX network, and so on). These ACLs are applied to an interface in the input or output direction using the ip access-group or ipx access-group command.
The following restrictions apply when using data-plane ACLs on the WS-X4232-L3:
ACLs are not supported on Gigabit EtherChannel (GEC) interfaces (that is, you cannot configure a data-plane ACL on a port-channel interface)
ACLs are not supported on subinterfaces of Gigabit EtherChannel (GEC) interfaces (that is, you cannot configure a data-plane ACL on a port-channel subinterface).
Reflexive and dynamic ACLs are not supported
ACL logging, ACL hit counters, and access-violations accounting are not supported
The implication of these restrictions is that you cannot configure the two internal Gigabit Ethernet interfaces as an EtherChannel bundle if you also wish to use data-plane ACLs to control traffic flow between VLANs.
The alternative is to configure each internal gigabit interface as a separate 802.1q trunk, each carrying different VLANs. This alternative is possible because configuring data-plane ACLs on subinterfaces of a main interface is allowed. (See the examples below.)
This document gives several answers on frequently asked questions for PFRv3 channel state behavior.
Q1: What are all the channel operational states from a BR (border role) perspective and what are the rules/conditions to be in each st...
The need was to reach an host inside a LAN through a VPN connection managed by the LAN gateway (Cisco 1921).
The LAN gateway performs NAT and there was a dedicate nat rule for the host i wanted to reach through VPN.
I couldn't connect to the hos...
We have 3 identical switches configured by someone else and would like to claim some of the Gigabit ports(G1/G2/G3/G4) for use on servers. When we try to change the wiring and configuration, we run in to connectivity issues. Attached is a des...