Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Mac ACL not working with 2960

Hi,

I have a 2960 with LAN Base image. It seems that it allows all the mac-address apart from that provided in the Mac ACL.

My idea is to allow only the mac-address applied in the ACL. I have other 2950 switches which are working fine with this type of ACLs.

Any solns if anybody has..

Regards,

4 REPLIES
Bronze

Re: Mac ACL not working with 2960

Hi,

Even though the command syntax is the same on the Catalyst 2960 switch and on the Catalyst 2950 switch, the semantics of the IP and the MAC ACL between the two platforms differ. For example, you can apply MAC ACLs for IP packets on the Catalyst 2950 switch, but on the Catalyst 2960 switch:

?You cannot apply MAC ACLs to IP packets.

?You cannot apply any ACLs for IPv6 frames.

?With MAC ACLs, an Ethertype of Appletalk is not supported.

There might be some config problem can u post ur configuration

and also can u tell me ur IOS type

Thanks

Raj

New Member

Re: Mac ACL not working with 2960

Hi,

The IOS I am using is c2960-lanbase-mz.122-25.FX.bin

mac access-list extended Infy6

permit host 0014.2233.cb70 any

permit host 0003.6b8b.0e37 any

permit host 0008.0d7b.7bf2 any

permit host 0008.0d57.7df2 any

interface FastEthernet0/42

switchport access vlan 84

switchport mode access

dot1x port-control auto

mac access-group Infy6 in

spanning-tree portfast

end

Any mac-address connected to this port is able to connect to the network.

Regards

Sagar

Bronze

Re: Mac ACL not working with 2960

Hi,

your command

mac access-list extended Infy6

permit host 0014.2233.cb70 any

Will block communication with this MAC TO ANY.

Try to use the deny command instead of permit and at the end use the command

permit any any

for ur example it would be

mac access-list extended Infy6

deny 0014.2233.cb70 any

deny 0003.6b8b.0e37 any

deny 0008.0d7b.7bf2 any

deny 0008.0d57.7df2 any

permit any any

HTH ,

Please tell me if it works.

Thanks

Raj

New Member

Re: Mac ACL not working with 2960

Sagar,

What kind of traffic do you try to block?

Note the following passage in the Command reference:

On Layer 2 interfaces, you can filter IP traffic by using IP access lists and non-IP traffic by using MAC access lists. You can filter both IP and non-IP traffic on the same Layer 2 interface by applying both an IP ACL and a MAC ACL to the interface.

Hope this helps, Chris.

833
Views
0
Helpful
4
Replies
CreatePlease login to create content