Hands-On Lab: Configuring VLAN Access Control Lists (VACLs)

Lab Objective

Configure a VLAN access-map that denies traffic between two specific hosts within the same VLAN while permitting all other traffic, apply it to the VLAN itself rather than an interface, and verify the filtering takes effect for intra-VLAN traffic.

Lab Purpose

A standard router-applied ACL, discussed earlier in this series, can only filter traffic that actually passes through a routed interface — two hosts communicating within the same VLAN never reach a router at all, making a normal ACL powerless to filter that traffic. A VACL applies directly to the VLAN, filtering traffic regardless of whether it is ever routed.

Lab Topology

Switch1 (VLAN 60, Layer 3 capable)
  Gi1/0/1 ---- PC-A: 192.168.60.10
  Gi1/0/2 ---- PC-B: 192.168.60.11
  Gi1/0/3 ---- PC-C: 192.168.60.12

Goal: block PC-A from reaching PC-B directly,
while PC-A and PC-C, and PC-B and PC-C, can
still communicate normally

Task 1: Verify Normal Connectivity Before Filtering

Confirm PC-A can currently ping PC-B, since both are in the same VLAN.

Task 2: Create an ACL Matching the Traffic to Deny

Create a standard ACL matching traffic specifically between PC-A and PC-B.

Task 3: Create the VLAN Access-Map

Create a VLAN access-map that drops traffic matching the ACL and forwards everything else.

Task 4: Apply the Access-Map to the VLAN

Apply the VLAN access-map directly to VLAN 60.

Task 5: Verify Filtering Takes Effect

Confirm PC-A can no longer reach PC-B, while both PC-A and PC-B can still reach PC-C.

Solution and Verification

PC-A> ping 192.168.60.11

Reply from 192.168.60.11: bytes=32 time=1ms
-- Normal connectivity confirmed before
-- the VACL is applied

Switch1(config)# access-list 101 permit ip host 192.168.60.10 host 192.168.60.11
Switch1(config)# access-list 101 permit ip host 192.168.60.11 host 192.168.60.10

-- Both directions matched explicitly, since
-- the VACL needs to catch traffic regardless
-- of which host initiates it

Switch1(config)# vlan access-map BLOCK-A-B 10
Switch1(config-access-map)# match ip address 101
Switch1(config-access-map)# action drop
Switch1(config-access-map)# exit
Switch1(config)# vlan access-map BLOCK-A-B 20
Switch1(config-access-map)# action forward

-- Sequence 20 with no match clause acts as
-- the "permit everything else" catch-all,
-- conceptually similar to needing an explicit
-- final permit in a route-map

Switch1(config)# vlan filter BLOCK-A-B vlan-list 60

-- Unlike ip access-group applied to an
-- interface, this VACL is applied directly
-- to the VLAN itself

PC-A> ping 192.168.60.11

Request timed out.
Request timed out.
Success rate is 0 percent (0/5)
-- Traffic between PC-A and PC-B is now
-- blocked, despite never crossing a
-- routed interface

PC-A> ping 192.168.60.12

Reply from 192.168.60.12: bytes=32 time=1ms
-- PC-A to PC-C remains completely unaffected,
-- confirming the filter is scoped precisely
-- to the specific host pair matched by ACL 101

Key Takeaway

A VLAN access-map's structure mirrors a route-map's sequenced match-and-action logic, discussed earlier in this series regarding BGP route maps, but its action keywords (forward/drop) and application point (vlan filter, applied to the VLAN rather than an interface) are entirely VACL-specific — this is the essential tool whenever filtering is needed for traffic that stays entirely within a single VLAN and never reaches a Layer 3 interface.