Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Cisco ACL confusion...

Hi All,

I have a couple of queries about the way ACLs work on Cisco Layer 3 switches... Namely a Cisco 6509 with IOS 12.2(18)

We have a number of VLANs running on the device and after creating a new 'Management' VLAN, we wanted to restrict access to this VLAN so only 2 out of our 20+ other VLANs could access the devices within.

Now, sounds fairly simple to me. BUT, we could only get it to work properly if we denied access form ALL 18 of ther other VLAN interfaces and not by placing a much smaller ACL at the Destination VLAN interface.

Does this make sense? Can anyone tell me if they should work the same as a PIX/Router ACL? Here is an example:

The Management VLAN is VLAN 8 with a network address of, the ACL is 180. Lets say we want to allow networks and to access the new VLAN, but NO others.

access-list 180 permit ip

access-list 180 permit ip

access-list deny ip any any

int vlan 8

ip access-group 180 in

Would this be on the right lines or am i missing something?

Many thanks

Hall of Fame Super Blue

Re: Cisco ACL confusion...

Hi Jonathan

Nothing wrong with the acl but you have applied in the wrong direction.

In is traffic coming from the management vlan going to other vlans.

Out is traffic going onto the management vlan from other vlans.

Try applying the access-list out and see what happens

int vlan 8

ip access-group 180 out



Re: Cisco ACL confusion...

Hi Jon,

Many thanks for this. The way i understood it is that an 'IN' statement applied to traffic going INTO the VLAN and an 'OUT' statement applied to traffic leaving the VLAN.

So, with VLAN interfaces, it is the other way round?

Hall of Fame Super Blue

Re: Cisco ACL confusion...


Think of it like this.

IN statement applies to traffic going into the interface rather than the vlan so in your example IN on vlan 8 means traffic going into the vlan 8 interface ie. traffic from vlan 8 servers.

OUT applies to traffic leaving the interface ie. traffic going out on vlan 8 interface - to the vlan 8 servers.

Hope this makes sense


Re: Cisco ACL confusion...

Hi Jon,

It does make sense! I was using the VLAN interfaces as 'Physical' interfaces, which obviously they are not.

I will give this a try in one of our test VLANs and see what happens.

Thank again,