Stopping MAC addresses on 3560 switch interfaces

[mark.osborne]

Hi,

I would like to stop certain MAC addresses connecting to the network via a 3560 switch and have configured the config below for VLAN 1. All interfaces belong to VLAN 1. Can anyone tell me if this is the correct config or have I missed something?

mac access-list extended Bad_Hosts

permit host 0011.434c.d9bf any 0x806 0x0

permit host 0011.434a.8026 any 0x806 0x0

permit host 000b.5d2a.23e3 any 0x806 0x0

permit host 000b.5d0e.4019 any 0x806 0x0

!

!

vlan access-map MAC 10

action drop

match mac address Bad_Hosts

vlan access-map MAC 20

action forward

vlan filter MAC vlan-list 1

Regards

Mark

Network Specialist

[stephtchoko]

It look like, all the host 'll be reject.

Try:

mac access-list extended Bad_Hosts

deny host 0011.434c.d9bf any 0x806 0x0

deny host 0011.434a.8026 any 0x806 0x0

deny host 000b.5d2a.23e3 any 0x806 0x0

deny host 000b.5d0e.4019 any 0x806 0x0

permit any any

!

!

vlan access-map MAC 10

match mac address Bad_Hosts

action forward

vlan access-map MAC 20

action drop

vlan filter MAC vlan-list 1

Please, hope this help and rate this post.