VMAN + ACL

[Alexandr_P]

Hello!

Have scheme:
Cisco (vman tag) -> (port24 vman tag) Extreme X440 ( port 23 vman untag) -> CheckPoint
BUT CheckPoint work in passive mode (only receive traffic), also I can't see MAC of CheckPoint, so traffic don't go to port 23 (X440 don't know whom send it)

May be ACL with action But for what vlan/port I have to map this ACL?

Thank you!

[Alexandr_P]

Hello, Nikolay!

I need to redirect unpacked vlan (vlan without outer vman tag)

Thank you!

[Necheporenko__N]

configure access-list redirect-all ports 24 ingress
Policy: redirect-all
entry one {
if match all {
vlan-id 77 # vman outer tag }
then {
permit ;
count all ;
redirect-port 23 ;
}
}
Number of clients bound to policy: 1

[Henrique]

Do you want to redirect all traffic (all vlans) or an specific vlan?

If you want to redirect an specific vlan traffic then I believe you should use "cvid" match-condition to match the inner-Vlan ID and then "redirect-port 21"

Regarding the mirroring, I'm not sure if there is any limitation when mirroring an inner-vlan. A lab might be good to confirm that.

[Henrique]

Hi Alexandr, what about creating an static FDB/ARP entry pointing to the checkpoint?