Port ACL (PACL) Restrictions and Design Considerations

Port Access Control Lists (PACLs) are ACLs that can be applied to Layer 2 switchports. However, they have certain restrictions compared to their Layer 3 counterparts.

These limitations are due to switch architecture and hardware considerations and include:

1. No Outbound (Egress) Filtering:
   • Switch ASICs process traffic in the switching path at egress
   • Adding outbound filtering would require re-analysis after forwarding decisions have already been made
   • Ingress processing is prioritized for performance optimization
   • Additional TCAM/CAM resources would be needed for outbound filtering
2. Control Plane Traffic:
   • PACLs cannot filter Layer 2 control protocols (CDP, VTP, DTP)
   • Control plane and data plane filtering must remain separate
   • Control Plane Policing (CoPP) should be used instead for control traffic
3. Protocol Support:
   • Support for filtering IPv6, ARP, and MPLS varies by platform
   • Hardware capabilities determine supported protocol filtering
   • Check platform documentation for specific protocol support

PACL limitations on Layer 2 are primarily driven by switch ASIC architecture, control plane separation requirements, and platform-specific hardware capabilities.

Links

https://networklessons.com/cisco/ccie-routing-switching-written/ipv6-pacl-port-acl