Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

mac acl in 3560 switch

Hi,

I have created a mac acl as descibed in the following link.

http://www.cisco.com/en/US/products/hw/switches/ps628/products_configuration_guide_chapter09186a00804cc117.html#wp1075613

But some times it works. But most of the time it is not working.

How to solve this?

Krishna.

6 REPLIES
VIP Purple

Re: mac acl in 3560 switch

Hello Krishna,

keep in mind that MAC access lists work for non-IP traffic only. What are you trying to accomplish ? If you need to block specific MAC addresses from entering a switchport, you might want to consider port security, as in the example below, where you would only allow a single specified MAC address to enter a port:

interface FastEthernet0/1

switchport port-security

switchport port-security maximum 1

switchport port-security mac-address 1234.1234.1234

As an alternative, if you want to block a certain MAC address from your entire switch, you could add a static entry for that MAC address and direct it to an unused port (GigabitEthernet0/2 in the example), as described below, effectively blackholing traffic for that MAC address:

mac-address-table static 0020.1223.e3f4 interface GigabitEthernet0/2

Since static entries take precedence over dynamic entries, all traffic for that MAC address wil effectively be dropped.

HTH,

GP

New Member

Re: mac acl in 3560 switch

Hi George,

We are using ip traffic only.

scenario

server A fa0/1 mac address x.x.x.x

server B fa0/2 mac address y.y.y.y

both are in the same vlan.

server b should only talk to server A. Any other traffic to server B from same vlan should be blocked.

can you please help me.

KRishna.

VIP Purple

Re: mac acl in 3560 switch

Hello Krishna,

port security should still work in your situation. Basically, what you do is to allow only the MAC addresses from server A and B to access the switchport where server B is connected to. Traffic from all other MAC addresses will be blocked. Since your server B is connected to interface FastEthernet0/2, the configuration of that interface should look like this:

interface FastEthernet0/2

switchport port-security

switchport port-security maximum 2

switchport port-security mac-address 1234.1234.1234

switchport port-security mac-address acab.1234.09k8

The MAC addresses specified are those of server A and B.

Does that make sense ? Let me know if you run into trouble...

Regards,

GP

New Member

Re: mac acl in 3560 switch

Hi George,

I applied the configuration as specified in your earlier update.

Nobody is able to reach server A when we applied the configuration on server B's port.

Please let me know the other options.

Krishna.

Purple

Re: mac acl in 3560 switch

Hi Krishna,

Would it be possible for you to post the config you have on Fast0/1 and Fast0/2 (together with the port security commands) ?

Thanks,

Paresh

New Member

Re: mac acl in 3560 switch

Hi ,

Please find below the configuration.

interface FastEthernet0/2

switchport port-security

switchport port-security maximum 2

switchport port-security mac-address 1234.1234.1234 -- mac address of A

switchport port-security mac-address acab.1234.09k8 - mac address of B

Int fa0/1

switchport mode access

also i tried VACL as specified in the below mentioned url

http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_example09186a0080470c39.shtml

Still it is not working.

please help

Krishna

760
Views
0
Helpful
6
Replies
CreatePlease to create content