Dell PowerConnect B-FCXs, Руководство по настройке

Страница: 358 / 1494

316 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
Defining MAC address filters
9
Defining MAC address filters
MAC layer filtering enables you to build access lists based on MAC layer headers in the
Ethernet/IEEE 802.3 frame. You can filter on the source and destination MAC addresses. The
filters apply to incoming traffic only.
You configure MAC address filters globally, then apply them to individual interfaces. To apply MAC
address filters to an interface, you add the filters to that interface MAC address filter group.
The device takes the action associated with the first matching filter. If the packet does not match
any of the filters in the access list, the default action is to drop the packet. If you want the system
to permit traffic by default, you must specifically indicate this by making the last entry in the access
list a permit filter. An example is given below.
Syntax: mac filter <last-index-number> permit any any.
For devices running Layer 3 code, the MAC address filter is applied to all inbound Ethernet packets,
including routed traffic. This includes those port associated with a virtual routing interface.
However, the filter is not applied to the virtual routing interface. It is applied to the physical port.
When you create a MAC address filter, it takes effect immediately. You do not need to reset the
system. However, you do need to save the configuration to flash memory to retain the filters across
system resets.
Configuration notes and limitations
•
MAC address filtering on PowerConnect devices is performed in hardware.
•
MAC address filtering on PowerConnect devices differ from other Dell PowerConnect devices
in that you can only filter on source and destination MAC addresses. Other Dell PowerConnect
devices allow you to also filter on the encapsulation type and frame type.
•
MAC address filtering applies to all traffic, including management traffic. To exclude
management traffic from being filtered, configure a MAC address filter that explicitly permits
all traffic headed to the management MAC (destination) address. The MAC address for
management traffic is always the MAC address of port 1.
•
MAC address filters that have a global deny statement can cause the device to block all
BPDUs. In this case, include exception statements for control protocols in the MAC address
filter configuration.
The following configuration notes apply to Layer 3 devices:
•
MAC address filters apply to both switched and routed traffic. If a routing protocol (for
example, OSPF) is configured on an interface, the configuration must include a MAC address
filter rule that allows the routing protocol MAC and the neighbor system MAC address.
•
You cannot use MAC address filters to filter Layer 4 information.
•
MAC address filters are supported on tagged ports in the base Layer 3, edge Layer 3, and full
Layer 3 software images.
Command syntax
To configure and apply a MAC address filter, enter commands such as the following.
PowerConnect(config)# mac filter 1 deny 3565.3475.3676 ffff.0000.0000
PowerConnect(config)# mac filter 2 deny any ffff.ffff.ffff ffff.ffff.ffff