topic Re: Unable to apply ACL on VE Interface in ICX Switches

Unable to apply ACL on VE Interface

defore — Sun, 04 May 2025 01:02:28 GMT

Hello,

We have some ICX 8200 Switches. I have built a couple of ACLs and VE interfaces on the switch. When I go to apply them to the interface, I do not get an "ip access-group" option. I do see this option on physical ports. I am not sure what I am missing here.

Thanks for your help.

Re: Unable to apply ACL on VE Interface

Nidhi — Sun, 04 May 2025 06:12:54 GMT

Hello Defore,

Greetings!

Please find below an example from our lab demonstrating how to apply an access-group to both an interface and a VLAN.

You can apply the "access-group" to vlan and the port not on the ve interface.

Step 1: Create the Access List

ICX8200-48ZP2 Router(config)# ip access-list extended test6789
ICX8200-48ZP2 Router(config-ext-ipacl-test6789)# exit

Step 2: Apply the ACL to Interface 1/1/2

ICX8200-48ZP2 Router(config)# interface ethernet 1/1/2
ICX8200-48ZP2 Router(config-if-e1000-1/1/2)# ip access-group test6789 in
Warning: Binding of large ACL Operation may take few minutes
ICX8200-48ZP2 Router(config-if-e1000-1/1/2)# ip access-group test6789 out
Warning: Binding of large ACL Operation may take few minutes
ICX8200-48ZP2 Router(config-if-e1000-1/1/2)# exit

Step 3: Apply the ACL to VLAN 100

ICX8200-48ZP2 Router(config)# vlan 100
ICX8200-48ZP2 Router(config-vlan-100)# ip access-group test6789 in
Warning: Binding of large ACL Operation may take few minutes
ICX8200-48ZP2 Router(config-vlan-100)# ip access-group test6789 out

Step 4: Verify Using Running Configuration

Interface Configuration:

ICX8200-48ZP2 Router(config)# show run interface ethernet 1/1/2
interface ethernet 1/1/2
 ip access-group test6789 in
 ip access-group test6789 out
!

VLAN Configuration:

ICX8200-48ZP2 Router(config)# show run vlan 100
vlan 100 by port
 ip access-group test6789 in
 ip access-group test6789 out
!
!

If the above steps do not help, please provide the following:

The error message or issue encountered while executing commands (include output snippet).
The software version currently running on the switch.

For more details, please refer to the ACL configuration guide for ICX switches.

Looking forward to your response.

Regards,
Nidhi

Re: Unable to apply ACL on VE Interface

defore — Sun, 04 May 2025 18:16:08 GMT

Thank you for the response. So, the ACL is applied to the VLAN directly and not the VLAN Interface (RVI/SVI), like it is in the Cisco world? I think that is what was confusing me.

Thanks,

Re: Unable to apply ACL on VE Interface

Nidhi — Mon, 05 May 2025 03:41:10 GMT

Hello Defore,

Yes, that's correct. We should apply the ACL directly to the VLAN.

Regards,

Nidhi

Re: Unable to apply ACL on VE Interface

defore — Mon, 05 May 2025 13:51:01 GMT

Can you help me understand the direction when applying this ACL to the port instead of the VE. When I apply my ACL to the in direction, I am still able to access the other networks. See below.

Extended IP access list GUEST_NETWORK

10: permit ip 192.168.200.0 0.0.0.255 host 192.168.200.254
20: deny ip 192.168.200.0 0.0.0.255 10.0.0.0 0.255.255.255
30: deny ip 192.168.200.0 0.0.0.255 192.168.0.0 0.0.255.255
40: deny ip 192.168.200.0 0.0.0.255 172.16.0.0 0.15.255.255
50: permit ip any any

VLAN 200

ip access-group GUEST_NETWORK in

Thanks,

Re: Unable to apply ACL on VE Interface

defore — Mon, 05 May 2025 20:05:16 GMT

Hello,

Looks like my last post did not get posted. Can you assist me with how the direction on the ACL works when applying to a port instead of an RVI/SVI? When I apply my ACL in the "in" direction on my vlan 200, I am still able to access the other networks.

Extended IP access list GUEST_NETWORK: 5 entries
10: permit ip 192.168.200.0 0.0.0.255 host 192.168.200.254
20: deny ip 192.168.200.0 0.0.0.255 10.0.0.0 0.255.255.255
30: deny ip 192.168.200.0 0.0.0.255 192.168.0.0 0.0.255.255
40: deny ip 192.168.200.0 0.0.0.255 172.16.0.0 0.15.255.255
50: permit ip any any

vlan 200

ip access-group GUEST_NETWORK in

Thanks,

Re: Unable to apply ACL on VE Interface

defore — Tue, 06 May 2025 18:03:33 GMT

I managed to resolve this. My ACL was written incorrectly. Turns out this was a /23 network. Also, for anyone else looking for information about this, here is a useful video about the ACL changes for 9.0 and above.

https://www.youtube.com/watch?v=qUhnuxZfbzQ

Thanks,