`apply access-list` (to interface or LAG)

Syntax

apply access-list {ip|ipv6|mac} <ACL-NAME> {in|out}

no apply access-list {ip|ipv6|mac} <ACL-NAME> {in|out}

Description

Applies an ACL to the interface (Individual front plane port) or Link Aggregation Group (LAG) identified by the current interface or LAG context.

The no form of this command removes application of the ACL from the current interface or LAG identified by the current interface or LAG context.

Command context

config-if

config-lag-if

Parameters

ip|ipv6|mac

Specifies the ACL type: ip for IPv4, ipv6 for IPv6, or mac for MAC ACL.

<ACL-NAME>

Specifies the ACL name.

in|out

Specifies the traffic direction on which the ACL is applied.

in specifies the inbound (ingress) traffic direction.
out selects the outbound (egress) traffic direction. Only for IPv4 ACLs. Not available for IPv6 or MAC ACLs.

Authority

Administrators

Usage

Each ACL of a given type can be applied to the same interface or LAG once in each direction. Therefore, using the apply access-list command on an interface or LAG with an already-applied ACL of the same type and direction will replace the currently applied ACL.
An ACL can be applied to an individual front plane port or to a Link Aggregation Group (LAG).
A port that is a member of a LAG with an applied ACL cannot have a different ACL applied to that member port.
When the port membership of a LAG with an applied ACL is changed, the LAG ACL is automatically applied or removed from that port depending on the modification type.
No ACLs (including ACLs for IPv4, IPv6, and MAC) are supported in egress on the Layer 2 interface. Egress ACLs can only be applied to Layer 3 (route-only) interfaces. Applying an egress ACL to a Layer 2 interface results in an error.

Examples

Applying MY_IP_ACL to ingress traffic on LAG 100 and apply to egress traffic on interface 1/1/2:

switch(config)# interface lag 100
switch(config-lag-if)# apply access-list ip MY_IP_ACL in
switch(config-lag-if)# exit

switch(config)# interface 1/1/2
switch(config-if)# apply access-list ip MY_IP_ACL out
switch(config-if)# exit
switch(config)#

Applying MY_IPV6_ACL to ingress traffic on interface 1/1/1 and apply to ingress traffic on LAG 100:

switch(config)# interface 1/1/1
switch(config-if)# apply access-list ipv6 MY_IPV6_ACL in
switch(config-if)# exit

switch(config)# interface lag 100
switch(config-lag-if)# apply access-list ipv6 MY_IPV6_ACL in
switch(config-lag-if)# exit
switch(config)#

Applying MY_MAC_ACL to ingress traffic on interface 1/1/1 and apply to ingress traffic on interface 1/1/2:

switch(config)# interface 1/1/1
switch(config-if)# apply access-list mac MY_MAC_ACL in
switch(config-if)# exit

switch(config)# interface 1/1/2
switch(config-if)# apply access-list mac MY_MAC_ACL in
switch(config-if)# exit
switch(config)#

Replacing MY_IP_ACL with MY_REPLACEMENT_ACL on interface 1/1/2:

switch(config)# interface 1/1/2
switch(config-if)# apply access-list ip MY_REPLACEMENT_ACL out
switch(config-if)# exit
switch(config)#

Unapplying MY_REPLACEMENT_ACL from interface 1/1/2 (out):

switch(config)# interface 1/1/2
switch(config-if)# no apply access-list ip MY_REPLACEMENT_ACL out
switch(config-if)# exit
switch(config)#

apply access-list (to interface or LAG)