Cisco Systems DOC-7814982 Creating Named MAC Extended ACLs

25-18

Catalyst 2950 Desktop Switch Software Configuration Guide

78-14982-01

Chapter 25 Con figuring Ne two rk Sec urity with ACLs

Configuring ACLs

In this example, the Jones subnet is not allowed to use outbound Telnet:

Switch(config)# ip access-list extended telnetting

Switch(config-ext-nacl)# remark Do not allow Jones subnet to telnet out

Switch(config-ext-nacl)# deny tcp host 171.69.2.88 any eq telnet

Creating Named MAC Extended ACLs

You can filter Layer 2 traffic on a physical Layer 2 interface by using MAC addresses and named MAC

extended ACLs. The p roce dure i s sim ila r t o tha t o f co nfiguring o t her ext ende d name d acce ss l ists.

Note Named MAC extended ACLs are used as a part of the mac access-group privileged EXEC command.

For more information abou t the supported non-IP pro tocols in the mac access-list extended command,

refer t o the co mman d referen ce for this release.

Note M atchi ng on a ny SNAP- enca psula ted pac ket wi th a non ze ro Organiza tio nal U nique Ident ifier (OU I) is

not supporte d.

Beginning in privileged EX EC mode, fol low these steps to cr eate a name d MAC extended ACL:

Use the no mac access-list extended name global conf iguration co mmand to dele te the entir e A CL. You

can a lso d ele te in dividual ACEs from n am ed M AC extended ACLs.

Command Purpose

Step 1 configure terminal Enter g lob al c onfigura tion m ode .

Step 2 mac access-list extended name Define an extend ed MAC access l ist by u sing a name .

Step 3 {deny | permit} {any | host source MAC

address} {any | host destination MA C addre ss}

[aarp | amber | appletalk | dec-spanning |

decnet-iv | diagnostic | dsm | etype-6000 |

etyp e-804 2 | lat | lavc-sca | mop-console |

mop-dump | msdos | mumps | net b ios |

vines-echo |vines-ip | xns-idp]

In extended MAC access-list co nfiguration mo de, specify to

permit or deny any source MA C address or a specific host source

MAC address and any dest inati on M AC address.

(Optional) You can also enter these options:

vines-ech o |vines -ip | xns-idp—( a non-I P p rot ocol) .

Step 4 end Return to pr ivileged EX EC m ode.

Step 5 show access-lists [numb er | name] Show the access list configuration.

Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.