MAC Access List Configuration Commands

I



Table of Contents

Chapter 1 MAC Access List Configuration Commands.............................................................................1
1.1 MAC Access List Configuration Commands................................................................................ 1

1.1.1 mac access-list......................................................................................................................1
1.1.2 permit......................................................................................................................................2
1.1.3 deny........................................................................................................................................ 3
1.1.4 mac access-group................................................................................................................ 3

II



MAC Access List Configuration
Commands

Chapter 1 MAC Access List Configuration
Commands

1.1 MAC Access List Configuration Commands
The MAC access list configuration commands include:

 mac access-list

 permit

 deny

 mac access-group

1.1.1 mac access-list

Syntax

To add or cancel a MAC access list, run the following command.

[no] mac access-list name

Parameters

Parameters Description

name MAC: Name of the MAC access list

Default Value

When there is a rule in the access list, an item- deny any any- will be added to the
end by default and the item will not show.

Usage Guidelines

This command is run in global configuration mode.

Example

The following example shows how to configure a mac-acl MAC access list.
Switch-config# mac access-list mac-acl
Switch-config-macl#

1



MAC Access List Configuration
Commands

1.1.2 permit

Syntax

To add or cancel an item to or from the MAC access list, run the following
command.

[no] permit {any | host src-mac-addr | src-mac-addr src-mac-mask } {any | host
dst-mac-addr | dst-mac-addr dst-mac-mask}[ arp [{any | src-ip-addr} {any |
dst-ip-addr }] | ethertype]

Parameters

Parameters Description Value Range

any Any value －

host Chassis －

src-mac-addr Stands for source MAC address H.H.H

src-mac-mask Stands for source mac mask H.H.H

dst-mac-addr Stands for destination MAC address H.H.H

dst-mac-mask Stands for destination mac mask H.H,H

arp Stands for matched arp packets －

src-ip-addr Stands for source IP address A.B.C.D

dst-ip-addr Stands for the destination IP address A.B.C.D

ethertype Type of the matched Ethernet packet 0x0600-0xFFFF

Default Value

All items are rejected.

Usage Guidelines

This command is running in MAC access list configuration mode.

Example

The following example shows how to set the MAC address of a host to
1234.5678.abcd.
Switch-config-macl#permit host 1234.5678.abcd any

2



MAC Access List Configuration
Commands

1.1.3 deny

Syntax

To add or cancel an item rejected by the MAC access list, run the following
command.

[no] deny {any | host src-mac-addr | src-mac-addr src-mac-mask } {any | host
dst-mac-addr | dst-mac-addr dst-mac-mask}[ arp [{any | src-ip-addr} {any |
dst-ip-addr }] | ethertype]

Parameters

Parameters Description Value Range

any Any value －

host Chassis －

src-mac-addr Stands for source MAC address H.H.H

src-mac-mask Stands for source mac mask H.H.H

dst-mac-addr Stands for destination MAC address H.H.H

dst-mac-mask Stands for destination mac mask H.H,H

arp Stands for matched arp packets －

src-ip-addr Stands for source IP address A.B.C.D

dst-ip-addr Stands for the destination IP address A.B.C.D

ethertype Type of the matched Ethernet packet 0x0600-0xFFFF

Default Value

All items are rejected.

Usage Guidelines

This command is running in MAC access list configuration mode.

Example

The following example shows how to reject a host whose MAC address is
1234.5678.abcd.
Switch-config-macl#deny host 1234.5678.abcd any

1.1.4 mac access-group

Syntax

Global：
3



MAC Access List Configuration
Commands

To apply the established MAC access list to an interface or in the global mode or
cancel a MAC access list which is already applied to an interface or in the global
mode, run the following command.

mac access-group name [vlan {word | add word | remove word}]

[no] mac access-group name [vlan ]

Port

[no] mac access-group name

Parameters

Parameters Description

name MAC: Name of the MAC access list

Vlan THE ACCESS LIST IS APPLIED IN INGRESS.

Word VLAN RANGE TABLE

add ADD VLAN RANGE TABLE

remove DELETE VLAN RANGE TABLE

Default Value

No MAC access list is applied to an interface.

Usage Guidelines

This command is configured in layer-2 interface configuration mode or the
interface configuration mode. If there is no access list, an access list with the
empty rule will be created.

Example

The following example shows how to configure the macacl MAC access list on
interface g0/1.
Switch_config_g0/1#mac access-group macacl

4