• How to Use ACLs for Enhanced Network Security
• Software Required
• Hardware Required
• Configuration
• ACL Web Configuration
• Real-World Scenario
• Resources & Documentation

How to Use ACLs for Enhanced Network Security

An Access Control List (ACL) is a list of permissions attached to an object. It specifies who or what is allowed to access the object and which operations are permitted.

The Layer 2 (L2) ACL function allows users to configure rules that reject packets from specific ingress ports or all ports. These rules inspect the packets’ source and destination MAC addresses. If a packet matches one of these rules, the system will perform the action “deny,” which means rejecting the packet.

Layer 3 (L3) is the Network Layer in the OSI model.

At this layer, the focus is on logical addressing and routing — how data moves between different networks.

Imagine a factory conveyor system with sensors and gates.

• The ACL is like the set of rules programmed into the control system that decides which products are allowed to move down the conveyor and which should be rejected.

• At Layer 2, the system checks the product’s barcode or label (MAC address). If it matches a “reject” rule, the gate pushes it off the line (deny).

• If a product triggers multiple sensors or rules, the system follows the highest-priority rule to decide whether the product passes or gets rejected.
• In short: ACLs in networking work like a factory quality-control system—automatically deciding which items (packets) continue on and which get removed.

At Layer 3, instead of just checking the product’s barcode or label, the system looks at the shipping address and destination information printed on the package (like an IP address). If the address matches a “reject” rule, the gate diverts it off the line (deny).

If a product matches multiple rules, the system applies the highest-priority rule to decide whether the package continues or is rejected.

In short: Layer 3 ACLs act like a quality-control system that makes decisions based on where the package is coming from and where it’s going, not just what it looks like on the outside.

Software Required

MapleLink Lite User Interface (Enter the network switch’s IP address into a web browser to access its web interface.

Hardware Required

• MS1-L05G01F
• MS1-L08G
• Embedded Industrial Box PC (A web browser is required. Use one of our Industrial Box PCs.)

Configuration

The ACL name should be the combination of the digit or the alphabet.

Where the MAC mask allows users to filter a range of MAC in the packets’ source MAC or destination MAC.

For example:

• source mac 00:01:02:03:04:05 ff:ff:ff:ff:00

• The command will filter source MAC range from 00:01:02:03:00:00 to 00:01:02:03:ff:ff

• Where the IPMASK mask allows users to filter a range of IP in the packets’ source IP or destination IP.

For example:

• source ip 172.20.1.1 255.255.0.0

• The command will filter source IP range from 172.20.0.0 to 172.20.255.255

Example:

• L2SWITCH#configure terminal

• L2SWITCH(config)#access-list 111

• L2SWITCH(config-acl)#vlan 2

• L2SWITCH(config-acl)#source interface 1

• L2SWITCH(config-acl)#show

• Profile Name: 111

• Activate: disabled

• VLAN: 2

• Source Interface: 1

• Destination MAC Address: any

• Source MAC Address: any

• Ethernet Type: any

• Source IP Address: any

• Destination IP Address: any

• Source Application: any

• Destination Application: any

ACL Web Configuration

Real-World Scenario

Using Layer 2 and 3 ACLs in an Industrial Automation Plant

Setting:
A large automotive manufacturing facility runs a centralized Ethernet network that interconnects production line controllers, robotic arms, HMI stations, and engineering laptops. VLANs are already in place to segment critical systems, but third-party vendors are sometimes given temporary wired access for diagnostics and maintenance.

The Problem:
During a maintenance window, a contractor connects their laptop to a port in the production VLAN to monitor a robot controller. Due to misconfiguration, the laptop begins sending network scans, probing PLCs, SCADA servers, and safety relays. Although no systems are compromised, the extra traffic adds jitter to time-sensitive control flows, raising concerns about lateral movement and operational disruption.

The Solution: Layer 2 and Layer 3 ACLs

To strike a balance between security and vendor access, the plant’s network engineer applies ACLs directly at the switch ports where non-production devices may connect.

How it Works:

• Layer 2 ACLs (MAC-based):
  • Ingress ACLs are configured to deny frames from contractor MAC addresses attempting to reach MACs belonging to critical automation assets (robot controllers, safety PLCs, historians).
  • This prevents unauthorized device-to-device communication at the Ethernet frame level, before IP or higher-layer traffic is even considered.
• Layer 3 ACLs (IP-based):
  • IP ACLs restrict contractor devices from sending traffic to sensitive IP subnets used by production controllers and SCADA servers.
  • Permits are included for legitimate destinations, such as a test PLC or remote support tools, ensuring authorized vendor work isn’t interrupted.
• Priority Handling:
  • Safety-critical devices (e.g., safety relays, interlock PLCs) are covered by explicit deny rules that override general access rules.
  • Normal plant traffic remains unaffected because ACLs only act on untrusted ingress ports.

Outcome:
If a contractor laptop attempts to scan or communicate with protected production assets, the switch drops the frames or packets locally, depending on whether the violation is caught by the Layer 2 or Layer 3 ACL. Critical operations remain unaffected, while vendors still retain access to their approved resources.

By using Layer 2 ACLs to stop unwanted traffic at the frame level and Layer 3 ACLs to enforce subnet- and IP-based restrictions, the facility creates a layered defense. This approach provides fine-grained access control without costly redesigns or full network re-segmentation—ensuring both security and operational continuity.

Resources & Documentation

Lite-Managed Network Switches Resources:

• Industrial Network Switches
• Industrial Lite-Managed Network Switches – MS1 Series Datasheet
• MS1-L05G01F Quick Start Guide
• MS1-L08G Quick Start Guide
• What is a network switch?
• Industrial Network Switch Operations Manual – Lite-Managed Series

More
Tutorials
Sample Projects
Software Downloads

See our Support Center for a complete list of Quick Start and Installation Guides