apply access-list (to VLAN)

Syntax

apply access-list {ip|ipv6|mac} <ACL-NAME> in

no apply access-list {ip|ipv6|mac} <ACL-NAME> in

Description

Applies an ACL to the VLAN identified by the current VLAN context.

The no form of this command removes application of the ACL from the VLAN identified by the current VLAN context.

Command context

config-vlan

Parameters

ip|ipv6|mac: Specifies the ACL type: ip for IPv4, ipv6 for IPv6, or mac for MAC ACL.
<ACL-NAME>: Specifies the ACL name.
in: Selects the inbound (ingress) traffic direction.

Authority

Administrators or local user group members with execution rights for this command.

Usage

Each ACL of a given type can be applied to the same VLAN once. Therefore, using the apply access-list command on a VLAN with an already-applied ACL of the same type, will replace the applied ACL.
When an ACL is applied to a VLAN, it will create hardware entries on all line cards regardless of whether a VLAN member exists on any specific line card.

Examples

Applying My_ip_ACL to ingress traffic on VLAN range 20 to 25:

switch(config)# vlan 20-25
switch(config-vlan-<20-25>)# apply access-list ip My_ip_ACL in

Applying My_ip_ACL to ingress traffic on VLAN 10:

switch(config)# vlan 10
switch(config-vlan-10)# apply access-list ip My_ip_ACL in

Applying My_ipv6_ACL to ingress traffic on VLAN 10:

switch(config)# vlan 10
switch(config-vlan-10)# apply access-list ipv6 My_ipv6_ACL in

Applying My_mac_ACL to ingress traffic on VLAN 10:

switch(config)# vlan 10
switch(config-vlan-10)# apply access-list mac My_mac_ACL in

Replacing My_ipv6_ACL with My_Replacement_ACL on VLAN 10 (following the preceding examples):

switch(config)# vlan 10
switch(config-vlan-10)# apply access-list ipv6 My_Replacement_ACL in

Removing (unapplying) several ACLs on VLAN 10:

switch(config)# vlan 10
switch(config-vlan-10)# no apply access-list ipv6 My_Replacement_ACL in
switch(config-vlan-10)# no apply access-list mac My_mac_ACL in