LogoفارسیFA

Hands-On Lab: Configuring VLAN Access Control Lists (VACLs)

This hands-on lab configures a VLAN Access Control List using a VLAN access-map to filter traffic within a single VLAN at Layer 2, something a standard router-applied ACL cannot achieve since traffic never leaves the VLAN to reach a routed interface.

VLAN Access-Map ConfigurationVACL FilteringIntra-VLAN Traffic Control

~3 min read · Updated Sep 23, 2026

Lab Objective

Configure a VLAN access-map that denies traffic between two specific hosts within the same VLAN while permitting all other traffic, apply it to the VLAN itself rather than an interface, and verify the filtering takes effect for intra-VLAN traffic.

Lab Purpose

A standard router-applied ACL, discussed earlier in this series, can only filter traffic that actually passes through a routed interface — two hosts communicating within the same VLAN never reach a router at all, making a normal ACL powerless to filter that traffic. A VACL applies directly to the VLAN, filtering traffic regardless of whether it is ever routed.

Lab Topology

Switch1 (VLAN 60, Layer 3 capable)
  Gi1/0/1 ---- PC-A: 192.168.60.10
  Gi1/0/2 ---- PC-B: 192.168.60.11
  Gi1/0/3 ---- PC-C: 192.168.60.12

Goal: block PC-A from reaching PC-B directly,
while PC-A and PC-C, and PC-B and PC-C, can
still communicate normally

Task 1: Verify Normal Connectivity Before Filtering

Confirm PC-A can currently ping PC-B, since both are in the same VLAN.

Task 2: Create an ACL Matching the Traffic to Deny

Create a standard ACL matching traffic specifically between PC-A and PC-B.

Task 3: Create the VLAN Access-Map

Create a VLAN access-map that drops traffic matching the ACL and forwards everything else.

Task 4: Apply the Access-Map to the VLAN

Apply the VLAN access-map directly to VLAN 60.

Task 5: Verify Filtering Takes Effect

Confirm PC-A can no longer reach PC-B, while both PC-A and PC-B can still reach PC-C.

Solution and Verification

PC-A> ping 192.168.60.11

Reply from 192.168.60.11: bytes=32 time=1ms
-- Normal connectivity confirmed before
-- the VACL is applied

Switch1(config)# access-list 101 permit ip host 192.168.60.10 host 192.168.60.11
Switch1(config)# access-list 101 permit ip host 192.168.60.11 host 192.168.60.10

-- Both directions matched explicitly, since
-- the VACL needs to catch traffic regardless
-- of which host initiates it

Switch1(config)# vlan access-map BLOCK-A-B 10
Switch1(config-access-map)# match ip address 101
Switch1(config-access-map)# action drop
Switch1(config-access-map)# exit
Switch1(config)# vlan access-map BLOCK-A-B 20
Switch1(config-access-map)# action forward

-- Sequence 20 with no match clause acts as
-- the "permit everything else" catch-all,
-- conceptually similar to needing an explicit
-- final permit in a route-map

Switch1(config)# vlan filter BLOCK-A-B vlan-list 60

-- Unlike ip access-group applied to an
-- interface, this VACL is applied directly
-- to the VLAN itself

PC-A> ping 192.168.60.11

Request timed out.
Request timed out.
Success rate is 0 percent (0/5)
-- Traffic between PC-A and PC-B is now
-- blocked, despite never crossing a
-- routed interface

PC-A> ping 192.168.60.12

Reply from 192.168.60.12: bytes=32 time=1ms
-- PC-A to PC-C remains completely unaffected,
-- confirming the filter is scoped precisely
-- to the specific host pair matched by ACL 101

Key Takeaway

A VLAN access-map's structure mirrors a route-map's sequenced match-and-action logic, discussed earlier in this series regarding BGP route maps, but its action keywords (forward/drop) and application point (vlan filter, applied to the VLAN rather than an interface) are entirely VACL-specific — this is the essential tool whenever filtering is needed for traffic that stays entirely within a single VLAN and never reaches a Layer 3 interface.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring HSRP for IPv6

This hands-on lab configures HSRP for IPv6 between two routers, demonstrating the option to use an automatically generated link-local virtual address rather than manually assigning one, and verifies failover behavior mirrors the IPv4 HSRP lab covered earlier in this series.

Continue

Hands-On Lab: Configuring SVI Autostate Exclude

This hands-on lab configures SVI autostate exclude on a monitoring port within a VLAN, preventing that single inactive port from incorrectly bringing down the SVI for an entire VLAN that still has other active member ports.

Continue

Hands-On Lab: Configuring Private VLANs (PVLANs)

This hands-on lab configures a full Private VLAN structure with a primary VLAN and both isolated and community secondary VLANs, demonstrating fine-grained Layer 2 isolation within a single IP subnet beyond what the simple protected-port feature from an earlier lab can achieve.

Continue

Hands-On Lab: Configuring Storm Control

This hands-on lab configures storm control thresholds on a switch port to limit broadcast and multicast traffic, simulating a broadcast storm and verifying the switch suppresses excess traffic before it can overwhelm the network.

Continue

Hands-On Lab: Configuring PVLAN Edge (Protected Ports)

This hands-on lab configures PVLAN Edge (protected ports) on two access ports within the same VLAN, isolating them from each other at Layer 2 while both retain normal connectivity to an uplink port, demonstrating a lightweight isolation feature that requires no separate VLAN.

Continue

Hands-On Lab: Configuring Flex Links

This hands-on lab configures Flex Links between two uplinks on an access switch, providing sub-second failover without relying on Spanning Tree at all, and verifies traffic automatically shifts to the backup link when the primary fails.

Continue
Previous ArticleNext Article