VLAN Access control list (VACL)

VACL is used to permit and deny the traffic within the VLAN itself. Here is the example showing how this feature works.

Example

!

!

vlan access-map NO_HTTP 10

 action drop

 match ip address 111

vlan access-map NO_HTTP 20

 action forward

!

vlan filter NO_HTTP vlan-list 10

! 

!

access-list 111 deny   tcp any any eq www

access-list 111 permit ip any any

Time-based ACL

Time-based ACL is one of the feature of dynamic ACL which allows us to specify the active and inactive time of the access-list.  Here is how configuration of time-based access-list look like.

Configuration
We allows the configured access-list to be active during day time operation and disable the access-list after hours. In this case, we assume the hours of operation is from 8am - 5pm.



time-range MYTIME
  periodic daily 8:00 to 17:00

access-list 100 dynamic ACL_DYN permit ip any any time-range MYTIME

Verify configuration


R2#sh access-lists
Standard IP access list 1
    10 permit 239.0.0.0, wildcard bits 0.255.255.255
Extended IP access list 100
    10 Dynamic ACL_DYN permit ip any any time-range MYTIME (inactive)
R2# sh clock
*22:05:17.614 UTC Fri Mar 1 2002
R2#

R2#sh access-lists

Standard IP access list 1

    10 permit 239.0.0.0, wildcard bits 0.255.255.255

Extended IP access list 100

    10 Dynamic ACL_DYN permit ip any any time-range MYTIME (active)

R2#sh clock

*14:07:02.310 PST Fri Mar 1 2002

R2#