`apply access-list` (to VLAN)

Syntax

apply access-list {ip|ipv6|mac} <ACL-NAME> in

no apply access-list {ip|ipv6|mac} <ACL-NAME> in

Description

Applies an ACL to the VLAN identified by the current VLAN context.

The no form of this command removes application of the ACL from the VLAN identified by the current VLAN context.

Command context

config-vlan

Parameters

ip|ipv6|mac: Specifies the ACL type: ip for IPv4, ipv6 for IPv6, or mac for MAC ACL.
<ACL-NAME>: Specifies the ACL name.
in: Specifies the inbound (ingress) traffic direction.

Authority

Administrators

Usage

Only one ACL type (ip, ipv6, or mac) may be applied to a VLAN at a time. Therefore, using the apply access-list command on a VLAN with an already-applied ACL of the same type, will replace the applied ACL.
When an ACL is applied to a VLAN, it will create hardware entries on all line cards regardless of whether a VLAN member exists on any specific line card.
If during hotswap or switch reboot, an ACL fails to be applied to a VLAN, the failed line card will shut down all its ports. The line card must be restarted (with the module command) to recover from the failure. If the 8400 has no line card installed, then the switch must be restarted. Modifying the VLAN or ACL configuration will not cause the line card to be restarted.

Examples

Applying My_ip_ACL to ingress traffic on VLAN 10.:

switch(config)# vlan 10
switch(config-vlan-10)# apply access-list ip My_ip_ACL in
switch(config-vlan-10)# exit
switch(config)#

Applying My_ipv6_ACL to ingress traffic on VLAN 10:

switch(config)# vlan 10
switch(config-vlan-10)# apply access-list ipv6 My_ipv6_ACL in
switch(config-vlan-10)# exit
switch(config)#

Applying My_mac_ACL to ingress traffic on VLAN 10:

switch(config)# vlan 10
switch(config-vlan-10)# apply access-list mac My_mac_ACL in
switch(config-vlan-10)# exit
switch(config)#

Replacing My_ipv6_ACL with My_Replacement_ACL on VLAN 10 (following the preceding examples):

switch(config)# vlan 10
switch(config-vlan-10)# apply access-list ipv6 My_Replacement_ACL in
switch(config-vlan-10)# exit
switch(config)#

Removing (unapplying) several ACLs on VLAN 10:

switch(config)# vlan 10
switch(config-vlan-10)# no apply access-list ipv6 My_Replacement_ACL in
switch(config-vlan-10)# no apply access-list mac My_mac_ACL in
switch(config-vlan-10)# exit
switch(config)#

apply access-list (to VLAN)