AboutAccess Control Lists · CommandorAction Purpose AttachestheUDFstotheing-ifacl TCAM region,whichappliestoIPv4orIPv6port ACLs. hardware access-list tcam region ing-ifacl 256 Example:

Configuring ACL

This chapter contains the following sections:

• About Access Control Lists, on page 1• Guidelines and Limitations for VXLAN ACLs, on page 2• VXLAN Tunnel Encapsulation Switch, on page 3• VXLAN Tunnel Decapsulation Switch, on page 9

About Access Control ListsTable 1: ACL Options That Can Be Used for VXLAN Traffic on Cisco Nexus 92300YC, 92160YC-X, 93120TX, 9332PQ, and 9348GC-FXPSwitches

SupportedTraffic TypeFlowDirection

Port TypeVTEP TypeACL TypeACLDirection

Scenario

YESNative L2traffic[GROUP:inner]

Access toNetwork[GROUP:encapdirection]

L2 portIngressVTEP

PACLIngress1



VLANIngressVTEP

VACL2



Tenant L3SVI

IngressVTEP

RACLIngress3

NOVXLANencap[GROUP:outer]


uplinkL3/L3-PO/SVI

IngressVTEP

RACLEgress4

Configuring ACL1

SupportedTraffic TypeFlowDirection

Port TypeVTEP TypeACL TypeACLDirection

Scenario

NOVXLANencap[GROUP:outer]

Network toAccess[GROUP:decapdirection]

UplinkL3/L3-PO/SVI

EgressVTEP

RACLIngress5

NONative L2traffic[GROUP:inner]


L2 portEgressVTEP

PACLEgress6



VLANEgressVTEP

VACL7a



DestinationVLAN

EgressVTEP

VACL7b

YESPost-decapL3 traffic[GROUP:inner]


Tenant L3SVI

EgressVTEP

RACLEgress8

ACL implementation for VXLAN is the same as regular IP traffic. The host traffic is not encapsulated in theingress direction at the encapsulation switch. The implementation is a bit different for the VXLAN encapsulatedtraffic at the decapsulation switch as the ACL classification is based on the inner payload. The supported ACLscenarios for VXLAN are explained in the following topics and the unsupported cases are also covered forboth encapsulation and decapsulation switches.

All scenarios that are mentioned in the previous table are explained with the following host details:

• Host-1: 10.1.1.1/24 VLAN-10

• Host-2: 10.1.1.2/24 VLAN-10

• Host-3: 20.1.1.1/24 VLAN-20

• Case 1: Layer 2 traffic/L2 VNI that flows between Host-1 and Host-2 on VLAN-10.

• Case 2: Layer 3 traffic/L3 VNI that flows between Host-1 and Host-3 on VLAN-10 and VLAN-20.

Guidelines and Limitations for VXLAN ACLsVXLAN ACLs have the following guidelines and limitations:

• A router ACL (RACL) on an SVI of the incoming VLAN-10 and the uplink port(eth1/2) does not supportfiltering the encapsulated VXLAN traffic with outer or inner headers in an egress direction. The limitationalso applies to the Layer 3 port-channel uplink interfaces.

Configuring ACL2

Configuring ACLGuidelines and Limitations for VXLAN ACLs

• A router ACL (RACL) on an SVI and the Layer 3 uplink ports is not supported to filter the encapsulatedVXLAN traffic with outer or inner headers in an ingress direction. This limitation also applies to theLayer 3 port-channel uplink interfaces.

• A port ACL (PACL) cannot be applied on the Layer 2 port to which a host is connected. Cisco NX-OSdoes not support a PACL in the egress direction.

Figure 1: Port ACL on VXLAN Encap Switch

VXLAN Tunnel Encapsulation Switch

Port ACL on the Access Port on IngressYou can apply a port ACL (PACL) on the Layer 2 trunk or access port that a host is connected on theencapsulating switch. As the incoming traffic from access to the network is normal IP traffic. The ACL thatis being applied on the Layer 2 port can filter it as it does for any IP traffic in the non-VXLAN environment.

The ing-ifacl TCAM region must be carved as follows:

Procedure

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

Step 1

switch# configure terminal

Configuring ACL3

Configuring ACLVXLAN Tunnel Encapsulation Switch


Attaches the UDFs to the ing-ifacl TCAMregion, which applies to IPv4 or IPv6 portACLs.

hardware access-list tcam region ing-ifacl256

Example:

Step 2

switch(config)# hardware access-listtcam region ing-ifacl 256

Creates an IPv4 ACL and enters IP ACLconfiguration mode. The name arguments canbe up to 64 characters.

ip access-list name

Example:switch(config)# ip access listPACL_On_Host_Port

Step 3

Creates an ACL rule that permits or deniesIPv4 traffic matching its condition.

sequence-number permit ip source-addressdestination-address

Step 4

Example: The source-address destination-addressarguments can be the IP address with aswitch(config-acl)# 10 permit ip

10.1.1.1/32 10.1.1.2/32 network wildcard, the IP address andvariable-length subnet mask, the host address,and any to designate any address.

Exits IP ACL configuration mode.exit

Example:

Step 5

switch(config-acl)# exit

Enters interface configuration mode.interface ethernet slot/port

Example:

Step 6

switch(config)# interface ethernet1/1

Applies a Layer 2 PACL to the interface. Onlyinbound filtering is supported with port ACLs.You can apply one port ACL to an interface.

ip port access-group pacl-namein

Example:switch(config-if)# ip port access-groupPACL_On_Host_Port in

Step 7

Configures the interface as a Layer 2 interface.switchport

Example:

Step 8

switch(config-if)# switchport

Configures the interface as a Layer 2 trunkport.

switchport mode trunk

Example:

Step 9

switch(config-if)# switchport mode trunk

Sets the allowed VLANs for the trunkinterface. The default is to allow all VLANs

switchport trunk allowed vlan vlan-list

Example:

Step 10

on the trunk interface, 1 through 3967 andswitch(config-if)# switchport trunkallowed clan 10,20

4048 through 4094. VLANs 3968 through4047 are the default VLANs reserved forinternal use.

Configuring ACL4

Configuring ACLPort ACL on the Access Port on Ingress


Negates the shutdown command.no shutdown

Example:

Step 11

switch(config-if)# no shutdown

VLAN ACL on the Server VLANA VLAN ACL (VACL) can be applied on the incoming VLAN-10 that the host is connected to on the encapswitch. As the incoming traffic from access to network is normal IP traffic, the ACL that is being applied toVLAN-10 can filter it as it does for any IP traffic in the non-VXLAN environment.

Figure 2: VLAN ACL on VXLAN Encap Switch

Procedure



Example:

Step 1



ip access-list name

Example:switch(config)# ip access listVacl_On_Source_VLAN

Step 2

Configuring ACL5

Configuring ACLVLAN ACL on the Server VLAN


Creates an ACL rule that permits or denies IPv4traffic matching its condition.


Step 3

Example: The source-address destination-addressarguments can be the IP address with a networkswitch(config-acl)# 10 permit ip 10.1.1.1

10.1.1.2 wildcard, the IP address and variable-lengthsubnet mask, the host address, and any todesignate any address.

Enters VLAN access-map configuration modefor the VLAN access map specified. If the

vlan access-map map-name [sequence-number]

Example:

Step 4

VLAN access map does not exist, the devicecreates it.switch(config-acl)# vlan access-map

Vacl_on_Source_Vlan 10If you do no specify a sequence number, thedevice creates a new entry whose sequencenumber is 10 greater than the last sequencenumber in the access map.

Specifies an ACL for the access-map entry.match ip address ip-access-list

Example:

Step 5

switch(config-acl)# match ip addressVacl_on_Source_Vlan

Specifies the action that the device applies totraffic that matches the ACL.

action forward

Example:

Step 6

switch(config-acl)# action forward

Enters VLAN access-map configuration modefor the VLAN access map specified.

vlan access-map name

Example:

Step 7

switch(config-acl)# vlan access mapVacl_on_Source_Vlan

Routed ACL on an SVI on IngressA router ACL (RACL) in the ingress direction can be applied on an SVI of the incoming VLAN-10 that thehost that connects to the encapsulating switch. As the incoming traffic from access to network is normal IPtraffic, the ACL that is being applied on SVI 10 can filter it as it does for any IP traffic in the non-VXLANenvironment.

Configuring ACL6

Configuring ACLRouted ACL on an SVI on Ingress

Figure 3: Routed ACL on an SVI on Ingress at VXLAN Encap Switch

The ing-racl TCAM region must be carved as follows:

Procedure



Example:

Step 1


Attaches the UDFs to the ing-racl TCAMregion, which applies to IPv4 or IPv6 portACLs.

hardware access-list tcam region ing-ifacl256

Example:

Step 2

switch(config)# hardware access-listtcam region ing-ifacl 256


ip access-list name

Example:switch(config)# ip access listPACL_On_Host_Port

Step 3



Step 4


10.1.1.1/32 10.1.1.2/32 network wildcard, the IP address and

Configuring ACL7



variable-length subnet mask, the host address,and any to designate any address.

Exits IP ACL configuration mode.exit

Example:

Step 5


Enters interface configuration mode.interface ethernet slot/port

Example:

Step 6

switch(config)# interface ethernet1/1

Negates shutdown command.no shutdown

Example:

Step 7


Applies a Layer 2 PACL to the interface. Onlyinbound filtering is supported with port ACLs.You can apply one port ACL to an interface.

ip access-group pacl-namein

Example:switch(config-if)# ip port access-groupRacl_On_Source_Vlan_SVI in

Step 8

Configure SVI for host.vrf member vxlan-number

Example:

Step 9

switch(config-if)# vrf member Cust-A

Prevents the device from sending redirects.no ip redirects

Example:

Step 10

switch(config-if)# no ip redirects

Configures an IP address for this interface.ip address ip-address

Example:

Step 11

switch(config-if)# ip address 10.1.1.10

Disables the ICMP redirect messages onBFD-enabled interfaces.

no ipv6 redirects

Example:

Step 12

switch(config-if)# no ipv6 redirects

Configure Anycast Gateway ForwardingMode.

fabric forwarding mode anycast-gateway

Example:

Step 13

switch(config-if)# fabric forwardingmode anycast-gateway

Configuring ACL8


Routed ACL on the Uplink on EgressA RACL on an SVI of the incoming VLAN-10 and the uplink port (eth1/2) is not supported to filter theencapsulated VXLAN traffic with an outer or inner header in an egress direction. This limitation also appliesto the Layer 3 port-channel uplink interfaces.

VXLAN Tunnel Decapsulation Switch

Routed ACL on the Uplink on IngressA RACL on a SVI and the Layer 3 uplink ports is not supported to filter the encapsulated VXLAN trafficwith outer or inner header in an ingress direction. This limitation also applies to the Layer 3 port-channeluplink interfaces.

Port ACL on the Access Port on EgressDo not apply a PACL on the Layer 2 port to which a host is connected. Cisco Nexus 9000 Series switches donot support a PACL in the egress direction.

VLAN ACL for the Layer 2 VNI TrafficA VLAN ACL (VACL) can be applied on VLAN-10 to filter with the inner header when the Layer 2 VNItraffic is flowing from Host-1 to Host-2.

Figure 4: VLAN ACL for the Layer 2 VNI on the VXLAN Decap Switch

Configuring ACL9

Configuring ACLRouted ACL on the Uplink on Egress

The VACL TCAM region must be carved as follows:

Procedure



Example:

Step 1


Changes the ACL TCAM region size.hardware access-list tcam region vacl 256

Example:

Step 2

switch(config)# hardware access-list tcamregion vacl 256


ip access-list name

Example:switch(config)# ip access listVXLAN-L2-VNI

Step 3

Specifies that the device maintains globalstatistics for packets that match the rules in theVACL.

statistics per-entry

Example:switch(config-acl)# statistics per-entry

Step 4



Step 5

Example: The source-address destination-addressarguments can be the IP address with a networkswitch(config-acl)# 10 permit ip

10.1.1.1/32 10.1.1.2/32 wildcard, the IP address and variable-lengthsubnet mask, the host address, and any todesignate any address.


sequence-number permit protocolsource-address destination-address

Step 6

Example: The source-address destination-addressarguments can be the IP address with a networkswitch(config-acl)# 20 permit tcp


Exit ACL configuration mode.exit

Example:

Step 7




Example:

Step 8

VLAN access map does not exist, the devicecreates it.switch(config)# vlan access-map

VXLAN-L2-VNI 10

Configuring ACL10

Configuring ACLVLAN ACL for the Layer 2 VNI Traffic


If you do no specify a sequence number, thedevice creates a new entry whose sequencenumber is 10 greater than the last sequencenumber in the access map.

Configure the IP list name.match ip address list-name

Example:

Step 9

switch(config-access-map)# match ipVXLAN-L2-VNI

VLAN ACL for the Layer 3 VNI TrafficA VLAN ACL (VACL) can be applied on the destination VLAN-20 to filter with the inner header when theLayer 3 VNI traffic is flowing from Host-1 to Host-3. It slightly differs from the previous case as the VACLfor the Layer 3 traffic is accounted on the egress on the system. The keyword output must be used whiledumping the VACL entries for the Layer 3 VNI traffic.

Figure 5: VLAN ACL for the Layer 3 VNI on the VXLAN Decap Switch

The VACL TCAM region must be carved as follows.

Configuring ACL11


Procedure



Example:

Step 1


Changes the ACL TCAM region size.hardware access-list tcam region vacl 256

Example:

Step 2

switch(config)# hardware access-list tcamregion vacl 256


ip access-list name

Example:switch(config)# ip access listVXLAN-L3-VNI

Step 3

Specifies that the device maintains globalstatistics for packets that match the rules in theVACL.

statistics per-entry

Example:switch(config)# statistics per-entry

Step 4



Step 5

Example: The source-address destination-addressarguments can be the IP address with a networkswitch(config-acl)# 10 permit ip


Configures the ACL to redirect-specific HTTPmethods to a server.

sequence-number permit protocolsource-address destination-address

Example:

Step 6

switch(config-acl)# 20 permit tcp20.1.1.1/32 10.1.1.1/32



Example:

Step 7

VLAN access map does not exist, the devicecreates it.switch(config-acl)# vlan access-map

VXLAN-L3-VNI 10If you do no specify a sequence number, thedevice creates a new entry whose sequencenumber is 10 greater than the last sequencenumber in the access map.

Specifies the action that the device applies totraffic that matches the ACL.

action forward

Example:

Step 8

switch(config-acl)# action forward

Configuring ACL12


Routed ACL on an SVI on EgressA router ACL (RACL) on the egress direction can be applied on an SVI of the destination VLAN-20 thatHost-3 is connected to on the decap switch to filter with the inner header for traffic flows from the networkto access which is normal post-decapsulated IP traffic post. The ACL that is being applied on SVI 20 canfilter it as it does for any IP traffic in the non-VXLAN environment.

Figure 6: Routed ACL on an SVI on Egress at the VXLAN Decap Switch

The egr-racl TCAM region must be carved as follows:

Procedure



Example:

Step 1


Changes the ACL TCAM region size.hardware access-list tcam region egr-racl256

Step 2

Example:switch(config)# hardware access-listtcam region egr-racl 256

Configuring ACL13

Configuring ACLRouted ACL on an SVI on Egress



ip access-list name

Example:switch(config)# ip access-listRacl_on_Source_Vlan_SVI

Step 3



Step 4


10.1.1.1/32 20.1.1.1/32 network wildcard, the IP address andvariable-length subnet mask, the host address,and any to designate any address.

Enters interface configuration mode, wherevlan-id is the ID of the VLAN that you wantto configure with a DHCP server IP address.

interface vlan vlan-id

Example:switch(config-acl)# interface vlanvlan20

Step 5

Negate the shutdown command.no shutdown

Example:

Step 6


Applies an IPv4 or IPv6 ACL to the Layer 3interfaces for traffic flowing in the direction

ip access-group access-list out

Example:

Step 7

specified. You can apply one router ACL perdirection.switch(config-if)# ip access-group

Racl_On_Detination_Vlan_SVI out

Configure SVI for host.vrf member vxlan-number

Example:

Step 8

switch(config-if)# vrf member Cust-A

Prevents the device from sending redirects.no ip redirects

Example:

Step 9

switch(config-if)# no ip redirects

Configures an IP address for this interface.ip address ip-address/length

Example:

Step 10

switch(config-if)# ip address20.1.1.10/24

Disables the ICMP redirect messages onBFD-enabled interfaces.

no ipv6 redirects

Example:

Step 11

switch(config-if)# no ipv6 redirects

Configure Anycast Gateway ForwardingMode.

fabric forwarding mode anycast-gateway

Example:

Step 12

Configuring ACL14


PurposeCommand or Actionswitch(config-if)# fabric forwardingmode anycast-gateway

Configuring ACL15


Configuring ACL16


Documents

AboutAccess Control Lists · CommandorAction Purpose AttachestheUDFstotheing-ifacl TCAM region,whichappliestoIPv4orIPv6port ACLs. hardware access-list tcam region ing-ifacl 256 Example: