ACL to block broadcast and multicast on one switch port

stefan-stefan · ‎07-12-2009

Hello,

This is probably going to be a very easy question for most of you but it would help me quite a bit.

What I want on one of our 3560 series switches is to prevent any broadcast and multicast traffice going to a port.

The reason for this is that there is a router behind it (not ours but supplied by our telecom company) which makes a connection to another office and I want the line (as its not a very big one) to be as clean as possible.

Its probably going to be something like this but just not sure if this is correct :

access-list 10 deny 255.0.0.0 0.255.255.255

access-list 10 deny 224.0.0.0 7.255.255.255

access-list 10 permit any

Thanks!

andrew.prince · ‎07-13-2009

Read the below link:-

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_25_se/configuration/guide/swtrafc.html

HTH>

stefan-stefan · ‎07-13-2009

So should I use protected ports instead ?

The article doesn't mention ACL's.

andrew.prince · ‎07-13-2009

I was thinking more along the lines of port blocking, this will block multicast and unicast.

Remember a router will NOT forward broadcasts.

Thotsaphon Lueangwattanaphong · ‎07-13-2009

Stefan,

Do you really want to do that way? (grin)

!

Switch(config)# interface gigabitethernet X/Y

Switch(config-if)# storm-control multicast level 0

Switch(config-if)# storm-control broadcast level 0

!

Let's start from here: http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_44_se/configuration/guide/swtrafc.html

HTH,

Toshi

ajenks · ‎10-21-2011

I am just looking at this document for a similar requirement as the original post - but isn't storm control for Ingress traffic?

andrew.prince · ‎10-21-2011

Correct - do you think that a switch just generates broadcast/unicast.multicast packets itself??

They HAVE to come IN from a port.

ajenks · ‎10-21-2011

Sure - but the original post was about not forwarding this traffic OUT through a specific port, so Egress (something I want to do) but dont think this is possible?

cadet alain · ‎10-21-2011

Hi,

if you do this

Switch(config-if)# storm-control multicast level 0

Then no more traffic will enter the port as soon as multicast packet enters the port because storm-control for multicast wiil block unicast also when the threshold is hit.

Alain.

Don't forget to rate helpful posts.

kishan1984 · ‎07-14-2009

try enabling igmp snooping(default is enable) and also type one command to enable switch to itself function as a igmp querier.