Catalyst 4500 – Unexpected Behavior with Object-Groups in ACLs

This is often a confusing topic for users new to SVIs as it does seem to work a bit counter intuitively. Most people have a tendency to look at the SVI as some sort of "gateway" and that traffic leaving the VLAN should be outbound and vice versa.

However, it actually works in the opposite way because the SVI is a virtual router interface. It can help to think of the SVI as a physical interface on a physical router connected to the VLAN. From the perspective of this router, traffic arriving on the interface (the SVI) from the VLAN is inbound. Traffic from the rest of the network to the VLAN would be going out (or outbound) from the perspective of this interface.

As an example, take for instance the following SVI:

interface Vlan10
 ip address 10.1.1.1 255.255.255.0
 ip access-group VLAN10_IN in
 ip access-group VLAN10_OUT out

Now, let's say I want to prevent any traffic with spoofed IP addresses from leaving this VLAN. My access list may look like the below. Notice that while this traffic is outbound from the VLAN, it is inbound to the interface and as such is an inbound ACL.

Sw6500#sh ip access-lists VLAN10_IN
Extended IP access list VLAN10_IN
    10 permit ip 10.1.1.0 0.0.0.255 any
    20 deny ip any any

If I want to limit access to this VLAN so that devices with 192.168.1.0/24 addresses are blocked but all other 192.168.0.0/16 addresses are allowed, the ACL would look something like this:

Sw6500#sh ip access-lists VLAN10_OUT
Extended IP access list VLAN10_OUT
    10 deny ip 192.168.1.0 0.0.0.255 any
    20 permit ip 192.168.0.0 0.0.255.255 any
    30 deny ip any any

Please Note: These are not a complete working access lists; they are meant only as examples. While they may work in certain environments, it may create problems if you try to use it. For instance, it will not allow traffic such as DHCP if the DHCP server is on a different VLAN.

One parting note, that may seem obvious but I have seen trip people up before. If the SVI has multiple subnets associated with it, you need to make sure your ACLs take this into account as traffic that passes between these subnets will be processed by the ACL even though it stays within the VLAN.

As long as you keep the concept that the SVI is an interface, this should be easy to accomplish.

Your access list should look like this:

ip access-list extended PORT-ACL

100 deny tcp any any eq 23
300 deny tcp any any eq 80
500 deny icmp any any timestamp-reply
1000 permit ip any any

interface GigabitEthernet1/0/1
description SERVER-DEVICE
ip access-group PORT-ACL OUT  <-- note change

The direction of the access list is in reference to the router, so OUT means from the router to the server. In that case, you will block traffic from other devices to the server when the TCP destination port is 23 or 80.