cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Switch ACL - how does it work

SOLVED
Highlighted
Building a reputation

Switch ACL - how does it work

H,

 

In reading this doc: https://documentation.meraki.com/MS/Other_Topics/Switch_ACL_Operation

 

It's not clear to me how these ACLs are applied. I'm assuming this is all L3 traffic - so are the ACL applied on all ports? If so, is it only applied when an L3 interface is created. It states that "Any traffic passing through the switch will be evaluated. Even traffic that is not routed." Passing in which direction (outbound or inbound)?

 

Thanks in advance,

-Jerome

 

 

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Kind of a big deal

Re: Switch ACL - how does it work

ACLs are available on L2 only switches, so these are not tied to an L3 SVI on a switch. 

 

This is a good question and I've never had to dig into the answer before... I've used these ACLs a few times and they do what they are supposed to do. So thinking about it I would hazard a guess that the ACLs are applied somewhere in the ingress side of the switch backplane, before a MAC table lookup is done to determine egress port (egress port being one of the physical ports for L2 forwarding, or an SVI for L3 forwarding). 

 

One big thing to remember with these ACLs is that they are stateless. 

View solution in original post

3 REPLIES 3
Highlighted
Kind of a big deal

Re: Switch ACL - how does it work

They are L4 ACLs as you can specify the src/dst port to filter on.

 

I think it applies on inbound traffic across all physical ports.

Highlighted
Kind of a big deal

Re: Switch ACL - how does it work

ACLs are available on L2 only switches, so these are not tied to an L3 SVI on a switch. 

 

This is a good question and I've never had to dig into the answer before... I've used these ACLs a few times and they do what they are supposed to do. So thinking about it I would hazard a guess that the ACLs are applied somewhere in the ingress side of the switch backplane, before a MAC table lookup is done to determine egress port (egress port being one of the physical ports for L2 forwarding, or an SVI for L3 forwarding). 

 

One big thing to remember with these ACLs is that they are stateless. 

View solution in original post

Highlighted
Building a reputation

Re: Switch ACL - how does it work

@jdsilva @PhilipDAth 

 

Thanks Gents! This helps clearing up some understanding how how these ACLs work.

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.