Cisco Systems 2960 Creating Named MAC Extended ACLs

28-20

Catalyst 2960 Switch SoftwareConfiguration Guide

78-16881-01

Chapter28 Configuring Network Security with ACLs

Creating Named MAC Extended ACLs

In this example of a named ACL, the Jones subnet is not allowed to use outbound Telnet:

Switch(config)# ip access-list extended telnetting

Switch(config-ext-nacl)# remark Do not allow Jones subnet to telnet out

Switch(config-ext-nacl)# deny tcp 171.69.0.0 0.0.255.255 any eq telnet

Creating Named MAC Extended ACLs

You can filter non-IPv4 traffic on a VLAN or on a Layer 2 interface by using MAC addresses and named

MAC extended ACLs. The procedure is similar to that of configuring other extended nam ed ACLs.

For more information about the supported non-IP protocols in the mac access-list extended command,

see the command reference for this release.

Note Though visible in the command-line help strings, appletalk is not supported as a matching co ndition for

the deny and permit MAC access-list configuration mode commands.

Beginning in privileged EXEC mode, follow these steps to create a named MAC extended ACL:

Command Purpose

Step1 configure terminal Enter global configuration mode.

Step2 mac access-list extended name Define an extended MAC access list using a name.

Step3 {deny | permit} {any | host source MAC

address | source MAC address mask} {any |

host destination MAC address | destination

MAC address mask} [type mask | lsap lsap mask

diagnostic | dsm | etype-6000 | etype-8042 | lat

mumps | netbios | vines-echo |vines-ip |

xns-idp | 0-65535] [cos cos]

In extended MAC access-list configuration mode, specify to

permit or deny any source MAC address, a source MAC address

with a mask, or a specific host source MAC address and any

destination MAC address, destination MAC address with a mask,

or a specific destination MAC address.

(Optional) You can also enter these options:

•type mask—An arbitrary EtherType number of a packet with

Ethernet II or SNAP encapsulation in decimal, hexadecimal,

or octal with optional mask of don’t care bits applied to the

EtherType before testing for a match.

•lsap lsap mask—An LSAP number of a packet with

IEEE 802.2 encapsulation in decimal, hexadecimal, or octal

with optional mask of don’t care bits.

| xns-idp—A non-IP protocol.

•cos cos—An IEEE 802.1Q cost of service number from 0 to 7

used to set priority.

Step4 end Return to privileged EXEC mode.

Step5 show access-lists [number | name] Show the access list configuration.

Step6 copy running-config startup-config (Optional) Save your entries in the configuration file.