Port Access Control Lists (PACLs)

A Port ACL (PACL) is a special kind of Access Control List (ACL) that is applied to a Layer 2 switch port to filter incoming traffic before it is forwarded based on MAC or IP addresses.

Key Characteristics of PACLs:

  1. Applied to Physical Layer 2 Ports – PACLs are configured on switchports rather than routed Layer 3 interfaces.
  2. Can Filter Based on IP or MAC Addresses – Unlike VLAN Access Lists (VACLs), which apply to all traffic in a VLAN, PACLs filter traffic entering a specific port.
  3. Ingress-Only Filtering – PACLs are applied to incoming traffic; they do not filter traffic exiting the port.
  4. Support for Standard, Extended, and MAC ACLs – Depending on the use case, the platform, and the IOS version, PACLs can be configured with:
    • IP ACLs (standard/extended) to filter based on IP addresses, protocols, and ports.
    • MAC ACLs to filter based on source and destination MAC addresses.

Depending on the platform and IOS version, PACLs have specific restrictions that should be taken into account.

https://networklessons.com/cisco/ccie-routing-switching-written/ipv6-pacl-port-acl

Links to this page: