Catalyst 3850, VLAN access map example (VACL, layer 2)

Question

Hello there:
Trying to get a simple VLAN access map example working (VACL, layer 2).  Want to allow hosts 10.0.0.2 to SSH to 10.0.0.3 (both in vlan 10), but deny all other connectivity from 10.0.0.2 to 10.0.0.3.
access-list test permit tcp host 10.0.0.2 host 10.0.0.3 eq 22
vlan access-map test
   match ip address test
   action forward
vlan filter test vlan-list 10
However, 10.0.0.2 cannot see 10.0.0.3 whatsoever, w/ this VACL enabled (connectivity works w/ VACL disabled).
From what I've read, there is an implicit deny all at the end, if I understand correctly.
I've played with other variations as well, but without any luck.
What am I missing here?
Also, is there a way to debug this using logs or debug statements? Nothing shows up in the logs.
Thank you.

Answer 1

Hi,
You have a problem in that your ACL currently allows the SSH traffic from 10.0.0.2 to 10.0.0.3 but the responses are not allowed to flow back from 10.0.0.3 to 10.0.0.2. That is the most probable reason your VACL does not work as expected.
This modification should correct the behavior:
ip access-list extended TestACL
permit tcp host 10.0.0.2 host 10.0.0.3 eq 22
permit tcp host 10.0.0.3 eq 22 host 10.0.0.2
deny ip host 10.0.0.2 host 10.0.0.3
deny ip host 10.0.0.3 host 10.0.0.2
permit ip any any
vlan access-map TestVACL
match ip address TestACL
action forward
vlan filter TestVACL vlan-list 10
Here, I've made sure that SSH traffic between 10.0.0.2 as a client and 10.0.0.3 as a server is allowed, any other traffic between these two is denied, and every other communication is allowed. Would you mind testing out this modification?
is there a way to debug this using logs or debug statements? Nothing shows up in the logs.
None that I know of. This filtering is done in hardware, independently from CPU, so the CPU has no insight into what's going on in the TCAM during packet filtering.
Best regards,
Peter