In which configuration mode is vlan filter [access-map] vlan-list [id] used?

The vlan filter [access-map] vlan-list [id] command is entered in Global Config mode on Cisco IOS devices.

SecurityGlobal Config

vlan filter [access-map] vlan-list [id]

Applies a VLAN access-map to filter traffic in a specified VLAN list, controlling which packets are forwarded or dropped based on configured match clauses.

Definition: vlan filter [access-map] vlan-list [id] is a Cisco IOS global config command. Applies a VLAN access-map to filter traffic in a specified VLAN list, controlling which packets are forwarded or dropped based on configured match clauses.

Overview

The `vlan filter` command is a critical security feature in Cisco IOS that applies a VLAN access-map to filter traffic within a specified VLAN list. This command allows network engineers to selectively forward or drop packets based on Layer 2, Layer 3, or Layer 4 criteria defined in the access-map. It is particularly useful for enforcing security policies, segmenting traffic, or mitigating attacks within a VLAN without requiring ACLs on each interface.

Unlike interface ACLs, VLAN filters operate on all traffic entering or leaving the VLAN, providing a centralized control point. This command is often used in conjunction with VLAN access-maps, which are similar to route-maps but for Layer 2 forwarding decisions. The filter is applied to the VLAN itself, affecting all ports in that VLAN.

It is important to note that VLAN filters are processed in hardware on most Catalyst switches, ensuring line-rate performance. However, they can impact CPU if the access-map contains complex match criteria. The command requires global configuration mode and privilege level 15.

When applied, the running configuration is updated immediately. Common alternatives include using private VLANs or port ACLs, but VLAN filters offer more granular control over traffic within the same VLAN. This command is essential for CCNA and CCNP candidates to understand for securing campus networks and preparing for troubleshooting scenarios involving inter-VLAN traffic filtering.

Syntax·Global Config

vlan filter [access-map] vlan-list [id]

When to Use This Command

Restrict inter-VLAN routing by filtering specific traffic between VLANs 10 and 20 using an access-map that matches source IP subnets.
Block all traffic from a guest VLAN (e.g., VLAN 100) to a corporate server VLAN (VLAN 200) while allowing return traffic.
Selectively permit or deny traffic based on Layer 3 or Layer 4 criteria within a VLAN, such as blocking Telnet but allowing SSH.
Apply a temporary security policy to a set of VLANs during a network audit without changing ACLs on interfaces.

Parameters

Parameter	Syntax	Required	Description
access-map	WORD	Required	The name of the VLAN access-map to apply. This map must be pre-configured with match and action clauses. Common mistake: applying a non-existent map, which results in no filtering.
vlan-list	WORD	Required	Specifies the VLAN IDs to which the filter is applied. Can be a single VLAN (e.g., 10), a range (e.g., 10-20), or a list (e.g., 10,20,30). Ensure VLANs exist; otherwise, the filter has no effect.
id	<1-4094>	Optional	Optional VLAN ID if using the 'vlan-list' keyword. Typically not used separately; the VLAN list is specified directly after 'vlan-list'.

Command Examples

Apply VLAN access-map to filter traffic in VLANs 10-20

vlan filter SECURITY_MAP vlan-list 10-20

This command applies the VLAN access-map named SECURITY_MAP to VLANs 10 through 20. No output is displayed if the command is accepted; use 'show vlan filter' to verify.

Apply VLAN access-map to multiple specific VLANs

vlan filter BLOCK_GUEST vlan-list 100,200,300

Applies the access-map BLOCK_GUEST to VLANs 100, 200, and 300. The command succeeds silently; verify with 'show vlan filter'.

Understanding the Output

The 'vlan filter' command itself produces no output. To verify the applied filter, use 'show vlan filter'. The output shows the access-map name and the VLAN list it is applied to.

For example: 'VLAN access-map SECURITY_MAP is filtering VLANs 10-20'. If no filter is applied, the output will be empty. In a real network, you should check that the correct access-map is associated with the intended VLANs.

A missing or incorrect filter could lead to security breaches or unintended traffic blocking.

Configuration Scenarios

Block all traffic from a specific host in VLAN 10

A security policy requires blocking all traffic from a rogue workstation (MAC 0050.7966.6800) in VLAN 10 while allowing other hosts.

Topology

Switch1---VLAN10---Host1 (0050.7966.6800) and Host2 (other MAC)

Steps

1.Step 1: Create a VLAN access-map named BLOCK_HOST with sequence 10.
2.Step 2: Configure match clause to match MAC address 0050.7966.6800.
3.Step 3: Set action to drop.
4.Step 4: Apply the VLAN filter to VLAN 10.

Configuration

! Create VLAN access-map
Switch(config)# vlan access-map BLOCK_HOST 10
Switch(config-access-map)# match mac address 100
Switch(config-access-map)# action drop
! Define MAC ACL
Switch(config)# mac access-list extended 100
Switch(config-ext-macl)# permit host 0050.7966.6800 any
! Apply filter
Switch(config)# vlan filter BLOCK_HOST vlan-list 10

Verify: Switch# show vlan access-map Switch# show vlan filter Expected output: VLAN 10 has filter BLOCK_HOST applied.

Watch out: The MAC ACL must be defined before referencing it in the access-map; otherwise, the match clause will be empty.

Permit only HTTP traffic from a subnet in VLAN 20

VLAN 20 contains web servers. Only HTTP traffic from the 192.168.20.0/24 subnet should be permitted; all other traffic dropped.

Topology

Switch1---VLAN20---Servers (192.168.20.0/24)---Clients (other subnets)

Steps

1.Step 1: Create an IP ACL to match HTTP traffic from subnet 192.168.20.0/24.
2.Step 2: Create VLAN access-map PERMIT_HTTP with sequence 10 to permit matching traffic.
3.Step 3: Create sequence 20 to drop all other traffic.
4.Step 4: Apply filter to VLAN 20.

Configuration

! Define IP ACL
Switch(config)# ip access-list extended HTTP_ONLY
Switch(config-ext-nacl)# permit tcp 192.168.20.0 0.0.0.255 any eq 80
! Create VLAN access-map
Switch(config)# vlan access-map PERMIT_HTTP 10
Switch(config-access-map)# match ip address HTTP_ONLY
Switch(config-access-map)# action forward
Switch(config)# vlan access-map PERMIT_HTTP 20
Switch(config-access-map)# action drop
! Apply filter
Switch(config)# vlan filter PERMIT_HTTP vlan-list 20

Verify: Switch# show vlan access-map PERMIT_HTTP Switch# show access-lists HTTP_ONLY Expected: ACL shows matches, and VLAN filter is active.

Watch out: If no default action is configured (sequence 20), the default is to forward. Always add a final drop sequence to enforce deny-all.

Troubleshooting with This Command

When troubleshooting VLAN filters, start by verifying the filter is applied with `show vlan filter`. Healthy output shows the VLAN list and access-map name. If no output appears, the filter is not applied.

Next, examine the access-map with `show vlan access-map [map-name]`. Look for the sequence numbers and actions. Common issues include missing match clauses or incorrect ACL references.

Use `show access-lists` to verify ACL counters; if counters are not incrementing, traffic is not matching. Also check if the VLAN exists with `show vlan id <vlan-id>`. If the VLAN is not present, the filter has no effect.

Another symptom is traffic being unexpectedly dropped; check the access-map sequence order—Cisco processes sequences in ascending order, and the first match applies. Ensure that permit/forward actions are placed before deny/drop actions. For hardware forwarding issues, use `show platform` commands to see if the filter is programmed in hardware.

If the filter is not working, check for TCAM exhaustion with `show platform tcam utilization`. Debug commands like `debug vlan filter` can show real-time decisions but should be used cautiously in production. Correlate with `show mac address-table` to verify MAC addresses are learned correctly.

If traffic is filtered unexpectedly, verify that the ACL matches the intended traffic direction; VLAN filters are bidirectional by default. Also, note that VLAN filters do not affect traffic between ports in the same VLAN if the switch uses hardware switching; they only apply to traffic entering or leaving the VLAN. For inter-VLAN routing, filters apply to traffic routed into or out of the VLAN.

Use `show ip interface` to check if VLAN interfaces are up and have IP addresses. Finally, remember that VLAN filters are not supported on all platforms; check platform documentation.

CCNA Exam Tips

CCNA 200-301 may test that 'vlan filter' is applied in global config mode, not interface config.

Remember that VLAN access-maps use 'match' and 'action' statements; the filter command only activates the map on a VLAN list.

The 'vlan-list' parameter can specify ranges (e.g., 10-20) or individual VLANs separated by commas.

Be aware that 'vlan filter' does not affect traffic within the same VLAN; it filters traffic entering or leaving the VLAN (e.g., inter-VLAN routing).

Common Mistakes

Applying the filter under interface configuration mode instead of global configuration mode.

Forgetting to create the VLAN access-map before applying the filter, resulting in no filtering.

Using 'vlan filter' without specifying a VLAN list, which is required.

vlan filter [access-map] vlan-list [id] vs enable password [password]

Both commands are configured in global configuration mode and impact security, but they operate at different layers: VLAN access-map filtering controls Layer 2/3 traffic forwarding within a VLAN, while enable password controls administrative access to privileged EXEC mode. They may be confused because both involve 'access' control, yet serve entirely distinct functions.

Aspect	vlan filter [access-map] vlan-list [id]	enable password [password]
Scope	Applies to traffic within a specific VLAN list; filters packets based on match clauses	Applies to user authentication for enable mode access on the device
Configuration mode	Global configuration, requires a previously defined VLAN access-map	Global configuration, directly sets a plaintext password
Persistence	Persists in running config; relies on access-map existing in NVRAM	Persists in running config; saved to startup config
Precedence	Evaluated per VLAN; overrides interface ACLs for bridged traffic	Used only when no enable secret is configured; enable secret takes precedence
Typical use	Restrict or permit traffic between VLANs or within a VLAN using ACL-like rules	Provide basic password protection for privileged mode (less secure)
Security level	Moderate; can implement granular traffic filtering but not encrypted	Low; password stored in plaintext, vulnerable to snooping

Use vlan filter [access-map] vlan-list [id] when you need to apply custom Layer 2/3 traffic policies (e.g., block specific hosts or protocols) to a range of VLANs without affecting inter-VLAN routing.

Use enable password [password] when you require a simple, non-encrypted password for privileged EXEC access on devices that do not support or need enable secret (e.g., legacy IOS or lab equipment).

Platform Notes

On IOS-XE (e.g., Catalyst 3650/3850/9300), the `vlan filter` command syntax is identical to classic IOS. However, on some IOS-XE platforms, the filter may be applied in software if the access-map uses complex match criteria, impacting performance. On NX-OS (e.g., Nexus 9000), the equivalent command is `vlan access-map` followed by `vlan filter`, but the syntax differs: `vlan access-map <map-name> <seq>` and then `match ip address <acl>` and `action {forward | drop}`.

The apply command is `vlan filter <map-name> vlan-list <vlan-id>`. NX-OS also supports `vlan filter` in the same way. On ASA, there is no direct equivalent; instead, use EtherType ACLs or VLAN ACLs (VACLs) via `access-list` and `access-group` commands.

In IOS versions 12.x and earlier, VLAN filters were introduced in 12.1(11)EA1; earlier versions lack this command. In 15.x and 16.x, the command remains consistent. IOS-XR does not support VLAN filters; use ACLs on interfaces or VRF-aware filtering instead.

Always verify platform support with `show vlan filter` before relying on the command.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions