VACL packet matching

Network and objective

Classic Catalyst VACL matching behavior: MAC ACL matches apply to non-IP traffic; verify exact IPv4/IPv6 and hardware support on the target platform.

An engineer tries to stop H1’s IPv4 traffic with a MAC access-list in a VLAN access map. The map is attached correctly, but ping continues. A later catch-all forward entry is present.

Ethernet switchingIllustrative topology

How it works

The packet contains both Ethernet and IP headers, but the VACL matching engine chooses the supported match path for its protocol type. On the classic behavior illustrated here, an IPv4 packet is evaluated by IP ACL matching, not by the MAC ACL intended for non-IP frames.

An ACL deny means the packet does not match that ACL for the current map entry; it is not the same as an access-map action drop. A packet can continue to a later forwarding sequence, so reversing permit and deny in a match ACL is a common mistake.

Use an IPv4 ACL for IPv4 criteria and a supported MAC ACL for non-IP EtherTypes when needed. Treat IPv6 separately according to platform support. Test ARP as well as IP because indiscriminate non-IP dropping can break address resolution before the intended IP policy is evaluated.

Configure or inspect

ip access-list extended H1-IP
 permit ip host 192.168.10.10 any
exit
vlan access-map PROTOCOL-POLICY 10
 match ip address H1-IP
 action drop
vlan access-map PROTOCOL-POLICY 20
 action forward
exit
vlan filter PROTOCOL-POLICY vlan-list 10

Verify the result

SW1#show vlan access-map
Vlan access-map PROTOCOL-POLICY 10
 Match clauses: ip address H1-IP
 Action: drop
Vlan access-map PROTOCOL-POLICY 20
 Match clauses: none
 Action: forward
Test result: H1 IPv4 blocked; unrelated ARP allowed

The corrected map matches H1’s IPv4 source directly. The final forwarding sequence preserves nonmatching traffic. The output demonstrates policy intent; platform-specific counters and a controlled capture should confirm hardware behavior.

Failure and recovery

A MAC-only match is used to drop IPv4 and a final action forward catches the traffic. The engineer assumes attachment failure when the real issue is packet-type matching.

Replace the IPv4 selection with match ip address and a permit entry for the intended packets. Keep a deliberate policy for remaining IP and non-IP traffic, then retest each protocol class independently.