Cisco Catalyst Blade Switch 3020 for HP Software Configuration Guide, Rel. 12.2(25)SEF1

26-28
Cisco Catalyst Blade Switch 3020 for HP Software Configuration Guide
OL-8915-01
Chapter 26 Configuring Network Security with ACLs
Configuring VLAN Maps
Using VLAN Maps in Your Network
These sections describes some typical uses for VLAN maps:
• Wiring Closet Configuration, page 26-28
• Denying Access to a Server on a VLAN, page 26-29
Wiring Closet Configuration
In a wiring closet configuration, the switch can support a VLAN map and a QoS classification ACL. In
Figure 26-3, assume that Host X and Host Y are in different VLANs and are connected to wiring closet
switches A and C. Traffic from Host X to Host Y is eventually being routed by Switch B, a Layer 3 switch
with routing enabled. Traffic from Host X to Host Y can be access-controlled at the traffic entry point,
Switch A.
Figure 26-3 Wiring Closet Configuration
If you do not want HTTP traffic switched from Host X to Host Y, you can configure a VLAN map on
Switch A to drop all HTTP traffic from Host X (IP address 10.1.1.32) to Host Y (IP address 10.1.1.34)
at Switch A and not bridge it to Switch B.
First, define the IP access list http that permits (matches) any TCP traffic on the HTTP port.
Switch(config)# ip access-list extended http
Switch(config-ext-nacl)# permit tcp host 10.1.1.32 host 10.1.1.34 eq www
Switch(config-ext-nacl)# exit
Switch A Switch C
Switch B
VLAN map: Deny HTTP
from X to Y.
HTTP is dropped
at entry point.
Host X
10.1.1.32
Host Y
10.1.1.34
VLAN 1
VLAN 2
Packet
101355