Cisco MAC filtering for Small Business / SG series

Cisco logo

We will see how to manage mac filtering with commands line on Cisco SG switch series.

Configuration

  • Switch model : Cisco SG550X
  • Switch model : Cisco SG350X

Create ACL

  • Create MF01 acl
Switch (config)# mac access-list extended MF01
  • Allow 24:B6:FD:14:08:53 mac address
Switch (config-mac-al)# permit 24:B6:FD:14:08:53 00:00:00:00:00:00 any ace-priority 20
  • Allow 48:bd:0e:02:ea:41 mac address
Switch (config-mac-al)# permit 48:bd:0e:02:ea:41 00:00:00:00:00:00 any ace-priority 10
  • Allow 00:11:xx:xx:xx:xx mac address family
Switch (config-mac-al)# permit 00:11:00:00:00:00 00:00:FF:FF:FF:FF any ace-priority 8
  • Every other addresses will be denied
Switch (config-mac-al)# deny any any ace-priority 40

Associate MF01 acl to interfaces

  • Configure interfaces from ge1/0/4 to ge1/0/18
Switch (config)# interface range ge1/0/4-18
  • Apply MF01 access list to interfaces
Switch (config-if-range)# service-acl input MF01
  • Disassociate MF01 access list with interfaces
Switch (config-if-range)# no service-acl input MF01

Useful Commands

  • Show access list
Switch # show access-lists MF01
Extended MAC access list MF01
    permit  host 48:bd:0e:02:ea:41 any ace-priority 10
    permit  host 24:b6:fd:14:08:53 any ace-priority 20
    deny    any any ace-priority 40
  • Remove acl rule
Switch (config)# mac access-list extended MF01
Switch(config-mac-al)# no permit 24:B6:FD:14:08:53 00:00:00:00:00:00 any
  • Remove acl
Switch (config)# no mac access-list extended MF01

Example

Let see how to allow only 00:11 MAC addresses family and 24:B6:FD:14:08:53 host. Any others addresses will be rejected

MAC filtering
  • Create access list
Switch (config)# mac access-list extended MF01
  • Allow 00:11:XX:XX:XX:XX family
Switch (config-mac-al)# permit 00:11:00:00:00:00 00:00:FF:FF:FF:FF any
  • Allow 24:B6:FD:14:08:53 host
Switch (config-mac-al)# permit 24:B6:FD:14:08:53 00:00:00:00:00:00 any
  • Deny any others host
Switch (config-mac-al)# deny any any
  • Apply MAC filtering to interfaces. Here from ge1/0/1 to ge1/0/24
Switch (config)# interface range ge1/0/1-24
Switch (config-if-range)# service-acl input MF01
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Contact :