Cisco Systems 3750E manual Mac access-list extended name, 36-48

Chapter 36 Configuring QoS

Configuring Standard QoS

Beginning in privileged EXEC mode, follow these steps to create a Layer 2 MAC ACL for non-IP traffic:

	Command	Purpose
Step 1
	configure terminal	Enter global configuration mode.
Step 2
	mac access-list extended name	Create a Layer 2 MAC ACL by specifying the name of the list.
		After entering this command, the mode changes to extended MAC
		ACL configuration.
Step 3 {permit deny} {host src-MAC-addr mask		Specify the type of traffic to permit or deny if the conditions are
	any host dst-MAC-addr dst-MAC-addr	matched, entering the command as many times as necessary.
	mask} [type mask]	• For src-MAC-addr, enter the MAC address of the host from
		which the packet is being sent. You specify this by using the
		hexadecimal format (H.H.H), by using the any keyword as an
		abbreviation for source 0.0.0, source-wildcardffff.ffff.ffff, or by
		using the host keyword for source 0.0.0.
		• For mask, enter the wildcard bits by placing ones in the bit
		positions that you want to ignore.
		• For dst-MAC-addr, enter the MAC address of the host to which
		the packet is being sent. You specify this by using the
		hexadecimal format (H.H.H), by using the any keyword as an
		abbreviation for source 0.0.0, source-wildcardffff.ffff.ffff, or by
		using the host keyword for source 0.0.0.
		• (Optional) For type mask, specify the Ethertype number of a
		packet with Ethernet II or SNAP encapsulation to identify the
		protocol of the packet. For type, the range is from 0 to 65535,
		typically specified in hexadecimal. For mask, enter the don’t
		care bits applied to the Ethertype before testing for a match.
		Note When creating an access list, remember that, by default, the
		end of the access list contains an implicit deny statement for
		everything if it did not find a match before reaching the end.
Step 4
	end	Return to privileged EXEC mode.
Step 5
	show access-lists[access-list-number	Verify your entries.
	access-list-name]
Step 6
	copy running-config startup-config	(Optional) Save your entries in the configuration file.

To delete an access list, use the no mac access-list extended access-list-nameglobal configuration command.

This example shows how to create a Layer 2 MAC ACL with two permit statements. The first statement allows traffic from the host with MAC address 0001.0000.0001 to the host with MAC

address 0002.0000.0001. The second statement allows only Ethertype XNS-IDP traffic from the host with MAC address 0001.0000.0002 to the host with MAC address 0002.0000.0002.

Switch(config)# mac access-list extended maclist1

Switch(config-ext-macl)#permit 0001.0000.0001 0.0.0 0002.0000.0001 0.0.0

Switch(config-ext-macl)#permit 0001.0000.0002 0.0.0 0002.0000.0002 0.0.0 xns-idp

! (Note: all other access implicitly denied)

	Catalyst 3750-E and 3560-E Switch Software Configuration Guide
36-48	OL-9775-02