47-20
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs
Configuring Unicast MAC Address Filtering
access-list 103 permit tcp any gt 1024 any gt 1023
Note Remember that source port lt 80 and destination port lt 80 are considered different
operations.
• Some packets must be sent to the CPU for accounting purposes, but the action is still performed by
the hardware. For example, if a packet must be logged, a copy is sent to the CPU for logging, but
the forwarding (or dropping) is performed in the hardware. Although logging slows the CPU, it does
not affect the forwarding rate. This sequence of events would happen under the following
conditions:
–
When a log keyword is used
–
When an output ACL denies a packet
–
When an input ACL denies a packet, and on the interface where the ACL is applied,
ip unreachable is enabled (ip unreachable is enabled by default on all the interfaces)
Configuring Unicast MAC Address Filtering
To block all unicast traffic to or from a MAC address in a specified VLAN, perform this task:
This example shows how to block all unicast traffic to or from MAC address 0050.3e8d.6400 in VLAN
12:
Switch# configure terminal
Switch(config)# mac-address-table static 0050.3e8d.6400 vlan 12 drop
Configuring Named MAC Extended ACLs
Note This section applies to Supervisor Engines II-Plus to 6-E (and 6L-E).
You can filter non-IP traffic on a VLAN and on a physical Layer 2 port by using MAC addresses and
named MAC extended ACLs. The procedure is similar to that of configuring other extended named
ACLs. You can use a number to name the access list, but MAC access list numbers from 700 to 799 are
not supported.
Note Named MAC extended ACLs cannot be applied to Layer 3 interfaces.
Command Purpose
Switch(config)# mac-address-table static mac_address
vlan vlan_ID drop Blocks all traffic to or from the configured unicast MAC
address in the specified VLAN.
To clear MAC address-based blocking, use the no form of this
command without the drop keyword.