Racl Vacl and PACL Many Types of ACLs

Last Updated on Tue, 23 Jul 2024 | Port Security

ACLs found on Ethernet switches often come in many shapes and forms, mostly because of the differences in hardware and software architectures on those platforms, but also because the functionality provided by ACLs has evolved over time. You are likely to come across three types of ACLs on an Ethernet switch:

• Router ACL (RACL). An IP-based ACL that is applied to a routed interface. It is the most common type of ACL. The ACL used in Example 16-1 is a RACL.

• VLAN ACL (VACL). Applies to traffic entering and leaving a VLAN. It is globally applied to all ports in a given VLAN. It can filter both on Layer 2 criteria (MAC addresses) and Layer 3 and 4 parameters, just like a RACL.

• Port-based ACL (PACL). A VACL applied to an individual switch port inside a VLAN.

Several switches also ship with options to perform more operations on packets than the standard permit/deny. For example, it is common for LAN switches to provide the capability to capture traffic matched by an ACL and send it off a capture port where a traffic analyzer resides. Another type of action includes redirecting matching traffic from its incoming port to another port.

Table 16-1 summarizes the differences and nuances of the three ACL types, which are detailed in the following sections.

Table 16-1 VACL/RACL/PACL: Summary

Table 16-1 summarizes the differences and nuances of the three ACL types, which are detailed in the following sections.

Table 16-1 VACL/RACL/PACL: Summary

RACL

VACL

PACL

Permits or denies the movement of traffic between Layer 3 subnets

Permits or denies the movement of traffic between Layer 3 subnets/VLANs or within a VLAN

Permits or denies the movement of traffic between Layer 3 subnets/VLANs or within a VLAN

Applied as an input or output policy to a Layer 3 interface

Applied as a policy to a VLAN interface; inherently applied to both inbound and outbound traffic

Applied as a policy to a Layer 2 switch port interface; applied for inbound traffic only

Continue reading here: Working with VACL

Was this article helpful?

+13 0

Recommended Books

  • Network Security: A Beginner's Guide
  • Network Security Fundamentals
  • Network Security Assessment
  • Network Security Bible

Related Posts

Readers' Questions

  • MAXIMILIAN
    What is a portbased acl used for?
    1 year ago
    • A port-based ACL is used to control traffic entering and leaving a network device. This type of access control list is commonly used in network firewalls and routers to filter traffic based on source and destination address, port number, and/or protocol.
    • rita medhanie
      How to configure pacl and vacl on the same switch?
      1 year ago
      • Configuring PACL and VACL on the same switch is relatively straightforward.
      1. Begin by logging into your switch and making sure that you have administrative privileges.
      2. Create a new VACL (VLAN Access Control List) and assign a name to it. This VACL will be used to control access to/from specific VLANs.
      3. Add the VLANs that you wish to control access to/from to the VACL.
      4. Next, create your PACL (Port Access Control List). Assign a name to this PACL and specify access rules for each port that you wish to control.
      5. Once the PACL has been created, bind it to the appropriate VLANs. This will ensure that all traffic to and from those VLANs will be subject to the PACL rules.
      6. Finally, save your configuration and test the PACL and VACL rules to ensure that they are functioning as expected.