VACL test for switch

A. Test topology:

R1------------SW1------------------(mac:2.2.2) R2

|

R3

R1,r2,r3 in VLAN11, R1 connection SW1 interface manually specify the MAC address for the 1.1.1,R2 connection SW1 interface manually specified MAC address is 2.2.2;

The IP address of the R1 interface is 10.1.1.1;

The IP address of the R2 interface is 10.1.1.2;

The IP address of the R3 interface is 10.1.1.3.

Two. Switch VACL the first configuration mode:

Mac Access-list Extended R2

Permit host 0002.0002.0002 Any (can only mask non-IP packets, such as ARP packets)

Access-list Permit IP host 10.1.1.3 any

VLAN ACCESS-MAP Test 10

Match IP Address 100

Action Drop

VLAN Access-map Test 20

Match MAC address R2

Action Drop

VLAN ACCESS-MAP Test 30

Action forward

!

VLAN Filter Test Vlan-list 11

Because SW1 rejected R2 packets (the ARP response packet was rejected), R1 and R3 do not have an ARP entry for the R2 interface address, which causes R1 to ping and Telnet R2, and if R1 manually add the ARP entry for the R2 interface address, R1 can pint and Telnet R2, It's OK to come back.

A.R1 PING R3

R1#ping 10.1.1.3

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.3, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

r3#

*feb 11:19:41.002:icmp:echo reply sent, src 10.1.1.3, DST 10.1.1.1

*feb 11:19:43.002:icmp:echo reply sent, src 10.1.1.3, DST 10.1.1.1

*feb 11:19:45.002:icmp:echo reply sent, src 10.1.1.3, DST 10.1.1.1

*feb 11:19:47.002:icmp:echo reply sent, src 10.1.1.3, DST 10.1.1.1

*feb 11:19:49.002:icmp:echo reply sent, src 10.1.1.3, DST 10.1.1.1

B.R3 PING R1

R3#ping 10.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

Turn on debug on R1 don't see packets arrive R1