VACL Feature
Virtual LAN (VLAN) access control lists (ACLs), or VACLs, control the redirection of all packets on a Catalyst 6000 family switch via a Policy Feature Card (PFC). VACLs, which are for security packet filtering, enable you to redirect traffic to specific physical switch ports. Unlike IOS ACLs, VACLs are not direction-specific. They automatically capture traffic traveling both inbound and outbound.
Capturing traffic with SPAN ports is accomplished with a single switch command. To utilize VACLs, however, you must perform the following four steps:
- Create a VACL to capture interesting traffic.
- Commit the VACL to memory.
- Map the VACL to specific VLAN(s).
- Assign the IDSM monitoring port as the VACL capture port.
Unlike SPAN, VACLs give you a much higher degree of control over the type of traffic that you want to capture. You can capture traffic based on the source IP address or the destination IP address, as well as specifying a specific IP protocol number. Depending on the IP protocol chosen, you may also be able to specify other parameters as well. With TCP, for instance, you can specify both the source and destination ports, and limit the capture to only packets from established TCP connections. Furthermore, your Multilayer Switch Feature Card (MSFC) can utilize flows to effectively ensure that packets sent between different VLANs will cross the switch's backplane only once, eliminating duplicate packets being captured.
A flow is essentially a traffic stream between two IP addresses, a source port and destination port, or a source IP address/port combination and a destination IP address/port combination.
The first step in utilizing VACLs to capture traffic for your IDSM is to actually create the VACL. To define a VACL, you use the set security acl ip switch command. The syntax for this command when capturing TCP traffic is as follows:
set security acl ip acl_name permit [tcp | 6] src_ip_address
[operator port [port]] dest_ip_address [operator port [port]]
[established] [capture]
Some other options for the permit keyword are the following:
- [ ip | 0 ]—Allows any IP traffic
- [ udp | 17 ]—Allows any UDP traffic
- [ icmp | 1 ]—Allows any ICMP traffic
The system automatically appends an implicit deny any any statement to the end of your VACL (similar to regular ACLs). Therefore, any traffic that is not explicitly permitted by your VACL cannot pass through your switch. Therefore, you need to create a permit statement at the end of your VACL that allows all unspecified traffic to pass through the switch. Otherwise, all traffic not specifically captured for analysis will be prevented from traversing the switch. You can do this by using the following command:
set security acl acl_name permit IP any any
Suppose you want to create a VACL that captures traffic matching the following characteristics:
- Traffic originating from the Class C network 192.21.81.0
- Traffic coming from ports 1—32000
- Traffic whose destination address is on the Class C network 10.2.1.0
- Traffic going to ports 1—1024
- IP Protocol of the traffic is TCP
To create a VACL named TCPACL to capture this traffic, you would use the following set security acl ip switch command.
Cat6K> (enable) set security acl ip TCPACL permit tcp
192.21.81.0 0.0.0.255 range 1 32000 10.2.1.0 0.0.0.255 lt 1024
TCPACL editbuffer modified. Use 'Commit' command to apply changes
Cat6K> (enable) set security acl ip TCPACL permit ip any any
TCPACL editbuffer modified. Use 'Commit' command to apply changes
Cat6K> (enable)
After creating your VACL to capture interesting traffic, you need to commit this VACL to your hardware. You use the commit security acl switch command to accomplish this, and it has the following syntax:
commit security acl acl_name | all
To commit our sample VACL named TCPACL, you would use the following command:
Cat6K> (enable) commit security acl TCPACL Hardware programming in progress... ACL TCPACL is committed to hardware. Cat6K> (enable)
Next, you need to map your VACL to specific VLANs on your switch by using the set security acl map switch command. This will enable the VACL to capture traffic from the VLANs that you map to it. The syntax for this command is as follows:
set security acl map acl_name vlan
Suppose that you want to map the sample VACL (TCPACL) to VLANs 100 and 120 on your switch. You can use the following switch commands:
Cat6K> (enable) set security acl map TCPACL 100 ACL TCPACL mapped to vlan 100 Cat6K> (enable) set security acl map TCPACL 120 ACL TCPACL mapped to vlan 120
You have defined the traffic that you are interested in, created an appropriate VACL, committed it to the hardware, and mapped it to specific VLANs on your switch. Now you need to configure the switch to send the captured traffic to the monitoring port on your IDSM so that it can examine the traffic for signs of intrusive activity. You need to use the set security acl capture-ports switch command to configure where to send the captured traffic. The syntax for this command is the following:
set security acl capture-ports {mod/ports…}
In this example, your IDSM line card is located in the fifth slot. Therefore, your command to define the correct capture port becomes the following:
Cat6> (enable) set security acl capture-ports 5/1 Successfully set 5/1 to capture ACL traffic. Cat6K> (enable)
VACLs overcome the session limitation imposed on SPAN ports because they capture traffic that matches a specified flow. This traffic can be from multiple VLANS and defined with a high degree of granularity with respect to specifying the interesting traffic that you want to capture. VACLS, however, do have a limitation. You are allowed to have only one VACL per protocol. This means that you can have only one VACL defined for capturing IP traffic. This one VACL, however, can be applied to multiple VLANS.