Cisco Catalyst 3650 Series, Command Reference Manual

Page: 817 / 1108

Usage Guidelines
Though visible in the command-line help strings, appletalk is not supported as a matching condition.
You enter MAC access-list configuration mode by using the
mac access-list extended
global configuration
command.
If you use the host keyword, you cannot enter an address mask; if you do not use the any or host keywords,
you must enter an address mask.
After an access control entry (ACE) is added to an access control list, an implied deny-any-any condition
exists at the end of the list. That is, if there are no matches, the packets are denied. However, before the first
ACE is added, the list permits all packets.
To filter IPX traffic, you use the type mask or lsap lsap mask keywords, depending on the type of IPX
encapsulation being used. Filter criteria for IPX encapsulation types as specified in Novell terminology and
Cisco IOS terminology are listed in the following table.
Table 37: IPX Filtering Criteria
Filter Criterion IPX Encapsulation Type
Novell Name Cisco IOS Name
EtherType 0x8137 Ethernet II arpa
EtherType 0x8137 Ethernet-snap snap
LSAP 0xE0E0 Ethernet 802.2 sap
LSAP 0xFFFF Ethernet 802.3 novell-ether
Examples This example shows how to define the MAC-named extended access list to allow NetBIOS traffic from any
source to MAC address 00c0.00a0.03fa. Traffic matching this list is allowed.
Device(config-ext-macl)#
permit any host 00c0.00a0.03fa netbios
This example shows how to remove the permit condition from the MAC-named extended access list:
Device(config-ext-macl)# no permit any 00c0.00a0.03fa 0000.0000.0000 netbios
This example permits all packets with EtherType 0x4321:
Device(config-ext-macl)# permit any any 0x4321 0
You can verify your settings by entering the
show access-lists
privileged EXEC command.
Related Commands
Description Command
Denies from the MAC access-list
configuration. Denies non-IP traffic to
be forwarded if conditions are matched. deny
Command Reference, Cisco IOS XE Everest 16.5.1a (Catalyst 3650 Switches)
791
permit (MAC access-list configuration)