Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

Filtering based on MAC address on an Cisco 2960 switch....

Hello,

 

I'm attempting to filter IP packet traffic based on MAC address using a 2960 switch.   I have several questions, are there any debug commands to view the success or failure of the mac address filtering?   The wireshark packet display is further down.   I just noticed while posting this issue that the Mac Addresses that I care about are in the 802.11 WLAN section of the packet, this probably means that I can't filter based on these particular  mac addresses.   The other problem that I see concerns the CAPWAP headers that are before the actual information that I care about.   I will post a message in the Wireless group also to see if I filter at the LWAPP controller.  Any help would be greatly appreciated Thank You in advance.

Regards,

 

Douglas Faron

 

 

 

My switch configuration is shown below:

 

 

!
Version 12.2
no service pad
service timestamps debug datatime msec
service timestamps log datetime msec
no service password-encryption
serice sequence-numbers
!
hostname WSLSwitch
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$GiOp$E/c4FWpIs9D236URVbgJd/
enable password aquila
!
!
!
no aaa new-model
clock timezone UTC -8
switch 1 provision ws-c2960s-24ps-l
!
!
no ip igmp snooping
vtp domain WSL
vtp mode transparent
!
!
crypto pki trustpoint TP-self-signed-788601984
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-788601984
 revocation-check none
 rsakeypair TP-self-signed-788601984
!
!
crypto pki certificate chain TP-self-signed-788601984
 certificate self-signed 01
  30820240 308201A9 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 37383836 30313938 34301E17 0D393330 33303130 30303233
  385A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
  532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3738 38363031
  39383430 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
  C154B76F C96C4D77 1606212E 2B0C567F 99E6DE3C D99C2B65 F7031D7D A2383A94
  85A9A8B9 83452423 E63FAB2B A1C20665 3C829B0C EF0923FB D4995D7C D982A517
  62CABFCC 3A473DAF 328985AC AC98F71F 3BDC0720 98A458D5 48E5B101 54E267CA
  6342026F 845E2CB7 E0B6D884 71CC6371 D7E12C1D 5843BD68 A0126686 1B3FE5C5
  02030100 01A36A30 68300F06 03551D13 0101FF04 05300301 01FF3015 0603551D
  11040E30 0C820A57 534C5377 69746368 2E301F06 03551D23 04183016 8014C502
  1D6710FA 9C60AAE0 31720211 73F8D9F8 E188301D 0603551D 0E041604 14C5021D
  6710FA9C 60AAE031 72021173 F8D9F8E1 88300D06 092A8648 86F70D01 01040500
  03818100 8CE7C76D B2B61087 BF69B333 BB36EFC6 7F0EBA60 1AC19967 D7C09CE6
  7AB6A559 452C070E 4E128F61 C87F0C40 D53939F7 8FBCEE88 533B19A2 59A37709
  0D7BEE80 3FA40682 76D797A9 8E536DA9 355F1CDF 3E2A1F0B 978B4871 D73327C1
  65E2405B 959B1C10 AE117F8C 4073A6C6 6524FB5A A65A7D7E 63E10B8C 2E104D23 BCCE60
F9
  quit
!
mac access-list extended MAC
 deny   host 0010.4067.4f6f host 0100.5e01.0101
 permit any any
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
no errdisable detect cause loopback
!
vlan internal allocation policy ascending
!
vlan 36
 name WSLWired
!
vlan 110
 name WSLPSK
!
vlan 111
 name WSLPSK2
!
vlan 112
 name WSLIAS1X
!
vlan 113
 name WSLIASWPA
!
vlan 114
 name WSLIASWPA2
!
vlan 115
 name WSLCISCO1X
!
vlan 116
 name WSLCISCOWPA
!
vlan 117
 name WSLCISCOWPA2
!
vlan 118
 name WSLFUNK1X
!
vlan 119
 name WSLFUNKWPA
!
vlan 120
 name WSLFUNKWPA2
!
vlan 121
 name WSLTEST1
!
vlan 122
 name WSLTEST2
!
vlan 123
 name WSLTEST3
!
vlan 124
 name WSLWEP128
!
vlan 125
 name WSLWEP64
!
vlan 250
 name WSLroaming
!
vlan 251
 name WSLOPEN
!
vlan 304
 name JHarriganNet
!
!
!
interface FastEthernet0
 no ip address
 shutdown
!
interface GigabitEthernet1/0/1
 description Jack 1.11; TestServer
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/2
 description Jack 1.26; Replacement Roaming Station
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/3
 description HP GB Switch step up to LWAPP Controller
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/4
 description Jack 1.19 Roaming Access Point
 switchport trunk native vlan 250
 switchport mode trunk
!
interface GigabitEthernet1/0/5
 description POE Jack 1.20; Roaming AP1
 switchport access vlan 250
 switchport trunk native vlan 250
 switchport mode trunk
!
interface GigabitEthernet1/0/6
 description Jack 1.21: Roaming AP 2
 switchport access vlan 250
 switchport trunk native vlan 250
 switchport mode trunk
!
interface GigabitEthernet1/0/7
 description Jack 1.25
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/8
 description POE; Jack 1.22; Roaming AP 2
 switchport access vlan 250
 switchport trunk native vlan 250
 switchport mode trunk
!
interface GigabitEthernet1/0/9
 description Jack 1.13 WSLSSAMC
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/10
 description Jack 1.12 WSLACS
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/11
 description Jack 1.16
 switchport access vlan 250
 switchport mode access
!
interface GigabitEthernet1/0/12
 description Jack 1.9
 switchport access vlan 36
 switchport mode access
 ip access-group 101 in
!
interface GigabitEthernet1/0/13
 description Jack 1.14
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/14
 description Jack 1.15
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/15
 description Jack 1.6
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/16
 description Open
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/17
 description Jack 1.24
 switchport access vlan 36
 switchport mode access
 mac access-group MAC in
!
interface GigabitEthernet1/0/18
 description Open
 switchport access vlan 36
 switchport mode access
 ip access-group 100 in
!
interface GigabitEthernet1/0/19
 description Jack 1.17
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/20
 description Jack 1.8
 switchport access vlan 36
 switchport mode access
!
interface GigabitEthernet1/0/21
 description Jack 1.23; Roaming WDS
 switchport trunk native vlan 250
 switchport mode trunk
!
interface GigabitEthernet1/0/22
 switchport access vlan 304
 switchport mode access
!
interface GigabitEthernet1/0/23
 switchport trunk native vlan 36
 switchport mode trunk
!
interface GigabitEthernet1/0/24
 description 2C/G48: SWTestSwitch Port 0/3
 switchport mode trunk
!
interface GigabitEthernet1/0/25
!
interface GigabitEthernet1/0/26
!
interface GigabitEthernet1/0/27
!
interface GigabitEthernet1/0/28
!
interface Vlan1
 ip address 172.31.31.1 255.255.255.0
 no ip route-cache
 shutdown
!
interface Vlan36
 ip address 172.31.31.250 255.255.255.0
 no ip route-cache
!
interface Vlan250
 ip dhcp relay information trusted
 no ip address
 no ip route-cache
!
ip default-gateway 172.31.31.1
ip http server
ip http secure-server
access-list 100 deny   ip host 172.31.31.31 host 172.31.31.241 log
access-list 100 permit ip any any log
banner login ^Che WSLSwich in the Cisco 2960 located in Wireless lab^C
!
line con 0
 logging synchronous
 stopbits 1
line vty 0 4
 password xxxxxx
 login
line vty 5 15
 password xxxxxx
 login
!
!
monitor session 1 source interface Gi1/0/17
monitor session 1 destination interface Gi1/0/23
ntp broadcastdelay 1000
ntp server 172.31.31.5 key 0
end

The packet that I'm attempting to filter (the problem is that I want to filter based on the WLAN Mac addresses) :

 

 

1 REPLY
New Member

you will have to use a packet

you will have to use a packet sniffer,

 

else run a script (if you know) on the switch.

94
Views
0
Helpful
1
Replies
CreatePlease to create content