Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1640 / 2086

62-16
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 62 Configuring Network Security with ACLs
Configuring Unicast MAC Address Filtering
•
Some packets must be sent to the CPU for accounting purposes, but the action is still performed by
the hardware. For example, if a packet must be logged, a copy is sent to the CPU for logging, but
the forwarding (or dropping) is performed in the hardware. Although logging slows the CPU, it does
not affect the forwarding rate. This sequence of events would happen under the following
conditions:
– When a log keyword is used
–
When an output ACL denies a packet
– When an input ACL denies a packet, and on the interface where the ACL is applied,
ip unreachable is enabled ( ip unreachable is enabled by default on all the interfaces)
Configuring Unicast MAC Address Filtering
To block all unicast traffic to or from a MAC address in a specified VLAN, perform this task:
This example shows how to block all unicast traffic to or from MAC address 0050.3e8d.6400 in VLAN
12:
Switch# configure terminal
Switch(config)# mac-address-table static 0050.3e8d.6400 vlan 12 drop
Configuring Named MAC Extended ACLs
You can filter non-IPv4, non-IPv6 traffic on a VLAN and on a physical Layer 2 port by using MAC
addresses and named MAC extended ACLs. The procedure is similar to that of configuring other
extended named ACLs. You can use a number to name the access list, but MAC access list numbers from
700 to 799 are not supported.
Note
Named MAC extended ACLs cannot be applied to Layer 3 interfaces.
For more information about the supported non-IP protocols in the mac access-list extended command,
refer to the Catalyst 4500 Series Switch Cisco IOS Command Reference .
Command Purpose
Switch(config)# mac-address-table static mac_address
vlan vlan_ID drop
Blocks all traffic to or from the configured unicast MAC
address in the specified VLAN.
To clear MAC address-based blocking, use the no form of this
command without the drop keyword.