DETAILED STEPS
Purpose
Command or Action
Enters the global configuration mode.
configure terminal
Example:
Switch#
configure terminal
Step 1
Identifies a specific interface, and enter interface
configuration mode. The interface must be a physical Layer
2 interface (port ACL).
interface interface-id
Example:
Switch(config)#
interface gigabitethernet1/0/2
Step 2
Controls access to the specified interface by using the MAC
access list.
mac access-group
{
name
} {
in
|
out
}
Example:
Switch(config-if)#
mac access-group mac1 in
Step 3
Port ACLs are supported in the outbound and inbound
directions.
Returns to privileged EXEC mode.
end
Example:
Switch(config-if)#
end
Step 4
Displays the MAC access list applied to the interface or
all Layer 2 interfaces.
show mac access-group
[
interface interface-id
]
Example:
Switch#
show mac access-group interface
Step 5
gigabitethernet1/0/2
(Optional) Saves your entries in the configuration file.
copy running-config startup-config
Example:
Switch#
copy running-config startup-config
Step 6
After receiving a packet, the switch checks it against the inbound ACL. If the ACL permits it, the switch
continues to process the packet. If the ACL rejects the packet, the switch discards it. When you apply an
undefined ACL to an interface, the switch acts as if the ACL has not been applied and permits all packets.
Remember this behavior if you use undefined ACLs for network security.
Related Topics
Restrictions for Configuring Network Security with ACLs, on page 105
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
134
OL-29434-01
Configuring IPv4 ACLs
Applying a MAC ACL to a Layer 2 Interface
