Traffic Filtering

Traffic filtering has traditionally been used on routers and firewalls to enforce access control policies. Most traffic filtering is performed at Layer 3 and Layer 4; hence, traffic filtering on switches (traditionally being Layer 2 devices) is a relatively new practice. With the importance of security and quality of service, switches need extra intelligence to provide the features that enable end-to-end security and quality of service.

NOTE

Support for these features varies by platform. For up to date feature support information, use the Feature Navigator at www.cisco.com/go/fn (CCO registration required).

Table 8-5 details the available traffic filtering features.

Table 8-5. Available Traffic Filtering Features

Feature	Description
Protocol filtering (CatOS only)	Filters Layer 2 frames based on Layer 3 protocol. Can explicitly permit or deny IP, IPX, and Group (includes AppleTalk and DECnet). Can automatically filter the protocols not in use on each switch port.
VLAN access control lists (Catalyst 6500 with CatOS only)	Applies IP- or MAC-based access control lists to a VLAN. The applied VLAN access control list (VACL) is used to filter traffic bridged within the VLAN, as well as traffic routed into the VLAN.
VLAN maps (Catalyst 3550 and 6500 with IOS)	Provides identical functionality to VACLs but with a different name.
Port-based access control lists (Catalyst 2950, 3550 and Cat6K with Supervisor 720)	On a Layer 2 port, Ccan filter inbound Layer 2 frames using MAC addresses as well as IP packets based on Layer 3 and Layer 4 information.
Routed access control lists	Identical to access control lists implemented on Cisco routers, these can be used on SVI and physical routed interfaces on Cisco Catalyst Layer 3 switches.
Private VLANs	Creates the idea of hierarchical VLANs with restricted Layer 2 connectivity. Promiscuous ports can communicate with any port in the VLAN, community ports can talk with any port in the same community and any promiscuous ports, and isolated ports can talk only with promiscuous ports.