Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

Blocking users using mac address

I have some users on our corporate network who I need to block from the network using mac address. I can't do this via dhcp because the users are using static IPs which they keep changing once it is blocked on the PIX 515E using the shun command.

How can I block access to these users on the PIX. The PIX is the default gateway.


Re: Blocking users using mac address

You cannot block by mac-address on the PIX.


Cisco Employee

Re: Blocking users using mac address

Andrew is right. You cannot block based on the mac-address on the PIX but, you can see if you can do this on the switch side using mac access-list

Re: Blocking users using mac address

You could also consider configuring your switch to0 use VMPS, depends on your switch platform.

If you do implement VMPS - you can create a specific VLAN for these users, then either block by IP address or route them into a black hole for non lAN traffic.

New Member

Re: Blocking users using mac address

I have a slightly complex situation at the moment which I hope to solve in the near future.

I inherited a flat network. No VLANs. No DMZ. In fact, the PIX acts as the LAN gateway with only 2 ports - one inside the other outside to a router which connects to the internet via vsat modem.

I hope to implement some control soonest using websence but before then, I am up to my chin troubled about this particular user that frequently changes his static IP and throttles the network badly.

What other method can I readily deploy to cut him permanently off the network? ...

Re: Blocking users using mac address

you can use private vlans - see the below url for config examples:-

Put this guy's switch port in a seperate VLAN and control him this way.

CreatePlease to create content