Which three statements apply to access control of both bridged and routed traffic for VLANs? (Choose three)
A.
Router ACLs can be applied to the input and output directions of a VLAN interface
B.
Bridged ACLs can be applied to the input and output directions of a VLAN interface
C.
Only router ACLs can be applied to a VLAN interface
D.
VLAN maps can be applied to a VLAN interface
E.
VLAN maps and router ACLs can be used in combination
I’m not sure if bridged ACLs means BVI ACLs, can somebody confirm this?
If bridged ACLs means BVI ACLs, not only router ACLs can be applied to a VLAN Interface. Interface configuration mode commands allow you to configure an interface or a bridge-group virtual interface (BVI). To create a BVI for a bridge group use the interface bvi command. Bridged mode requires access control lists (ACLs) to allow the traffic to pass. To apply an ACL to the inbound or outbound direction of an interface and make the ACL active, use the access-group command in interface configuration mode for the VLAN. A bridge group interface supports extended ACLs for IP traffic, and EtherType ACLs for non-IP traffic. After you create an ACL, you can apply it to one or more interfaces. ACLs can be applied on either the inbound or the outbound direction of an interface. To apply an ACL to one or more interfaces, use the command ip access-group {access-list-number | name} {in | out}. IP standard ACLs applied to the ingress of a Bridge Group Virtual Interface (BVI) will be applied to all bridged IP traffic in the associated bridge-group, in addition to the BVI ingress traffic.
Router ACLs access-control routed traffic between VLANs and are applied to Layer 3 interfaces.You can apply router ACLs on switch virtual interfaces (SVIs), which are Layer 3 interfaces to VLANs; on physical Layer 3 interfaces; and on Layer 3 EtherChannel interfaces. You can apply one router ACL in each direction on an interface (inbound or outbound).
You can use both router ACLs and VLAN maps on the same switch.
You can apply apply VLAN maps to VLANs but you cannot apply a VLAN map to a VLAN interface
This example shows how to apply VLAN map 1 to VLANs 20 through 22
Switch(config)# vlan filter map 1 vlan-list 20-22
Bridged ACLs are the same thing as VACLs – VLAN ACLs. A VACL or bridged ACL cannot be applied to a BVI (interface vlan #). It is created via the “vlan access-map” command and applied to the entire VLAN via the “vlan filter” command. So you can apply a router (standard or extended ACL) to the BVI in either direction. You can apply a VACL to all traffic flowing through the VLAN but it isn’t applied in a particular direction. And you can both apply a router ACL to the BVI and a VACL to the VLAN as a whole at the same time – use them in combination.