Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

2960 Allow only PPPoE on port

Hi all,

is there any way to allowe only PPPoE comunication on ethernet port on 2960X or 2960S catalyst switches?




Everyone's tags (2)
VIP Super Bronze

2960 Allow only PPPoE on port


I don't think you can configure PPPOE on switches.  You need a router.


Cisco Employee

Re: 2960 Allow only PPPoE on port

Hi Reza,

I think David's question focused on something else: can you configure an access port on a switch so that the only frame it accepts is a PPPoE frame?

In my opinion, that should be possible - the easiest way of doing that would simply be to configure a port-ACL (PACL) that drops all IP traffic whatsoever. PPPoE-encapsulated packets are not treated as IP packets by the switch, so IP PACL will not apply. So simply doing something like this should do the trick:

ip access-list standard NoIP

deny any


interface FastEthernet0/1

ip access-group NoIP in

If we wanted to be very precise, we could also create a MAC ACL to further narrow down the non-IP traffic allowed through a port. PPPoE uses EtherType values 0x8863 and 0x8864. The MAC ACL would need to be carefully specified, though, to allow other Layer2 control and management plane traffic (STP, DTP, VTP, CDP, LLDP, PAgP/LACP, UDLD, LOOP...), so it could be more difficult to create properly.

I even believe that creating a VACL would be possible although the VACLs are not officially supported on 2960 Catalysts yet (still, with a very recent IOS, they can be created and used just fine).

Best regards,


VIP Super Bronze

2960 Allow only PPPoE on port

Hi Peter,

Thanks for clarification.  I may have misunderstood the question.

Happy New Year with all the best!!!!!


Cisco Employee

2960 Allow only PPPoE on port


Happy New Year with all the very best to you too, my friend!

Best regards,


VIP Purple

2960 Allow only PPPoE on port

I understand your question that you don't want to terminate it on the switch (as Reza assumes) but send it through; is that what you want to do?

In either case I don't think that you can only allow PPPoE on a port. But perhaps (completely untested) you can limit the communication with an ACL that denys all ip traffic. At least "normal" IP shouldn't be allowed then any more but still everything else that are other ethernet-based protocols.

Don't stop after you've improved your network! Improve the world by lending money to the working poor:

CreatePlease to create content