MAC Access-List Configuration

I



Table of Contents

Table of Contents

Chapter 1 MAC Access-List Configuration..................................................................................................1
1.1 Create MAC access-list...................................................................................................................1
1.2 Configuring items of MAC access-list........................................................................................... 1
1.3 Applying MAC access-list................................................................................................................2

II



MAC Access-List Configuration

Chapter 1 MAC Access-List Configuration
Access-list configuration includes:

 Create MAC access-list

 Configuring items of MAC access-list

 Applying MAC access-list

1.1 Create MAC access-list
A MAC access-list must be created first before applying it on the port. When a
MAC access-list has been created, it enters MAC access-list configuration mode,
under which items of MAC access-list can be configured.

Enter privilege mode and use the following steps to add or delete a MAC
access-list.

Command Purpose

config Enters the global configuration mode.

[no] mac access-list name To add or cancel a MAC access list, run the
following command.

name stands for the name of theMACaccess
list.

1.2 Configuring items of MAC access-list
In MAC access-list configuration mode, specify to permit or deny any source MAC
address or a specific host source MAC address and any destination MAC address.
The same items can be configured in a MAC access list only once.

Enter MAC access list configuration mode and use the following steps to set MAC
access list entry.

Command Purpose

[no] {permit | deny} {any | host To add/delete aMAC access list entry, run the
src-mac-addr | src-mac-addr previous command. You can repeat this
src-mac-mask } {any | host command to add/delete multiple MAC access
dst-mac-addr | dst-mac-addr list entry.
dst-mac-mask}[ arp [{any |
src-ip-addr} {any | dst-ip-addr }] | any means match with any MAC address;
ethertype] src-mac-addr stands for source MAC address;

src-mac-mask stands for source mac mask;

dst-mac-addr stands for destination MAC
address;

dst-mac-mask stands for destination mac mask;

1



MAC Access-List Configuration

arp stands for matched arp packet;

src-ip-addr stands for source ip address stands
for source ip address

dst-ip-addr stands for the destination ip address

ethertype stands for type of the matched
Ethernet packet

exit Log out from the MAC list configuration mode
and enter the global configuration mode again.

exit Goes back to the EXEC mode.

write Saves the settings.

MAC list configuration example

Switch_config#mac access-list 1
Switch-config-macl#permit host 1.1.1 any
Switch-config-macl#permit host 2.2.2 any

The above configuration is to compare the source MAC address, so the mask is
the same. The configuration is successful.

1.3 Applying MAC access-list
The created MAC list can be applied on any physical port. Only one MAC list can
be applied to a port. The same MAC list can be applied to multiple ports.Enter the
privilege mode and perform the following operation to configure the MAC list.

Enter the privilege mode and perform the following operation to configure the MAC
list.

Command Purpose

config Enters the global configuration mode.

interface g0/1 Enters the to-be-configured port.

Apply the created MAC list to the port or
delete the applied MAC list from the

[no] mac access-group name port.name means the name of the MAC list.

Name MAC: Name of the MAC access list

exit Goes back to the global configuration mode.

exit Goes back to the EXEC mode.

write Saves the settings.

2