ACLs and VLAN Maps

Since a vlan is logical, it means comes in and is processed by a logical vlan interface, which would be at any number of physical ingress points based on trunks or access ports.

It seems to me that the forwarding process from say, VLAN 10 to VLAN

I would agree with that, so I would assume that in that case, a vacl and an acl would both apply to that traffic. However, if it is vlan

Another link:

Actually, I'm surprised that you agreed with me. I still don't exactly understand this but I was expecting you to say that one cannot filter by applying an ACL between two VLANs - they are always referenced to physical ports only. (BTW, thanks for the pointer to configuring VACLs but I don't need them for this L3 application.)

I want to allow traffic from a few servers on VLAN 10 into VLAN 20. I applied the acl to int vlan 20 out. This works.

ip access-list extended allow-servers permit ip 192.168.10.64 0.0.0.3 192.168.20.0 0.0.0.255 interface Vlan10 ip address 192.168.10.1 255.255.255.0 interface Vlan20 ip address 192.168.20.1 255.255.255.0 ip access-group allow-servers out

If the forwarding process is another valid ingress point for VLAN 20 then I could apply the acl to int vlan 10 out or to int vlan 20 in and both would be equivalent to applying it to vlan 20 out. This doesn't sound right.

I'd love to test this myself but I can't reconfigure the production environment until next weekend and I don't have any L3 switches in my home lab.

PS: Can you recommend an L3 switch that may be available for cheap on ebay? Preferably one that has not been end-of-life for too long.

You can apply an ACL to a port or a SVI. You just need to remember that it will only 'run' against traffic that is coming 'in' from a different network, or 'out' to a different network. This is where vlan acls or maps come in to play, as they will 'run' against intra- vlan traffic. There are many cases where technologies will do the same thing, just as you cite. An ACL in on one vlan is the exact same as an ACL 'out' on another, when you are talking about the same traffic stream that goes between those two networks. However, one may give you more versatility if you are trying to block more than one specific source network, or you want to impact all traffic to a specific destination network. As an example, if you only want one IP to access a specifc IP address, you don't put 'out' ACLs on each source vlan, you just put one 'in' ACL on the destination VLAN or network. A very basic example, but it shows the flexibility.

What features are you looking for in a l3 switch? Multiple SVIs and vlans? If that is the case, a 3500 series or the modern equivalent (3700) would probably do you fine. If this is for lab purposes, a

The 3550 looks like a good choice but the cheapest I see it is around $550. Will a 2950 also route between multiple SVIs? They are readily available for a lot less money and the 2950 "offers Layer 2 switching with intelligent Layer 2 - 4 services." That sounds like L3 switching to me.

Don't quote me on this because I don't work with smaller end gear too often, but I think the 2950 only supports one management interface, and its not really a SVI as its just for management of the device. If you want to get true multiple vlan configurations that are 'owned' on the switch, I think you need to go to a 3500 series. I'm sure someone else will weigh in here and may know of more updated information, but I know the 2924 would shut down vlan 1 if you configured another vlan and brought it up. The same would happen with any additional vlan interface. Of course this will still work fine if you have a router and configure it as a router on a stick (router has multiple interfaces, and trunk them over to the switch). This works fine for theory and lab, just not for any performance driven testing as all traffic inter-vlan will need to go up that one uplink and back down.