Hello Tom,
Thank you for your response!
My question is almost answered:
-The ACL works for ingress traffic only which can be descriminated by several different methods. Since a SVI is the the VLAN interface, you can discriminate the subnet or specific IP addresses contained within effectively making access rules for the VLAN even if it is not bound to the virtual interface.
I’ve tested this; the problem is the IP ACL will only become active after it is bound to a LAG or port (and then will only apply to that specific port). Otherwise this would indeed be te answer! Would this be normal behaviour for the SG300 in Layer 3 mode? How can one force an ACL to be active, without binding it to a LAG or port?
-The same VLAN traffic of a layer 2 device would be locally switched. For inter-VLAN communication the traffic would have to be sent to the routed interface. Since the traffic is restricted ingress only on the SX300 I do not see a complication as a connected layer 2 device request would be ingress to the Sx300 switch port.
So binding the ACL to the L3 switch’s local trunk port would be sufficient to control access between all subnets trunked to the remote switch…
How about a request from a local port on the L3 switch to a port belonging to the remote L2 switch: that would be egress from the trunk’s point of view, and therefore would not be filtered by an ACL bound to the trunk port. Wich brings another problem along: If there are multiple ACL’s to be applied for the remote ports on the L2 switch, all these ACL’s must be bound to the trunk port. The switch only allows 1 ACL per port, while I use more ACL’s (one per subnet) to keep it “simple”.
Of course this last problem can be overcome by using the ACL’s without binding them. I'm not aware if this is possible and how to achieve this…
