Cisco Systems 4500 Configuring EtherType Matching

47-22
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs
Configuring EtherType Matching
Switch(config)# mac access-list extended mac1
Switch(config-ext-nacl)# hardware statistics
Switch(config-ext-nacl)# end
Switch# show access-lists
Extended MAC access list macl
deny any any decnet-iv (old) protocol-family decnet (new)
permit any any
hardware statistics
Configuring EtherType Matching
Note This section applies to Supervisor Engine 6-E, Supervisor Engine 6L-E, and the Catalyst 4900M chassis.
You can classify non-IP traffic based on the EtherType value using the existing MAC access list
commands. When you classify non-IP traffic by EtherType, you can apply security ACLs and QoS
policies to traffic that carry the same EtherType.
EtherType matching allows you to classify tagged and untagged IP packets based on the EtherType
value. Tagged packets present a potential operation problem:
• While single-tagged packets are supported on the access and trunk ports, double-tagged packets are
not.
• Single and double-tagged packets are not supported if the port mode is dot1qtunnel.
For more information about the mac access-list extended command, refer to the Catalyst 4500 Series
Switch Cisco IOS Command Reference.
To create a named MAC extended ACL, perform this task:
This example shows how to create and display an access list named matching, permitting the 0x8863 and
0x8040 EtherType values:
Command Purpose
Step 1 Switch# configure terminal Enters global configuration mode.
Step 2 Switch(config)# [no] mac access-list
extended name Defines an extended MAC access list using a name.
To delete the entire ACL, use the no mac access-list extended
name global configuration command. You can also delete
individual ACEs from named MAC extended ACLs.
Step 3 Switch(config-ext-macl)# {deny | permit}
{any | host source MAC address | source
MAC address mask} {any | host destination
MAC address | destination MAC address
mask} [protocol-family {appletalk |
arp-non-ipv4 | decnet | ipx | ipv6 (not
supported on Sup 6-E and 6L-E)| rarp-ipv4
| rarp-non-ipv4 | vines | xns} |
ethertype]
In extended MAC access-list configuration mode, specify to
permit or deny any based upon the EtherTypes value, valid values
are 15636-65535.
Note You can specify matching by either EtherTy pe or p r oto c ol
family but not both.
Step 4 Switch(config-ext-macl)# end Returns to privileged EXEC mode.
Step 5 Switch# show access-lists [number | name]Shows the access list configuration.
Step 6 Switch(config)# copy running-config
startup-config (Optional) Saves your entries in the configuration file.