Mac address filter in Catalyst 2900 XL 1

[vacevedo]

I have a group of mac addresses and I want only this group of mac addresses to have access to the switch ports I select.

I haven´t found a way to do it in a Cisco Catalyst 2900XL 24 port switch.

I'm using the 12.0(5.2)XU, MAINTENANCE IE, IOS version.

Thanks in advance.

 

[hexn]

I believe you are looking for port-security. It is an interface command used to assign mac-addresses to an interface. Everything else will be filtered.

http://www.cisco.com/en/US/products/hw/switches/ps637/produc

ts_configuration_guide_chapter09186a008007e838.html#31465

 

[vacevedo]

Hi,

I guess that solution doesn't fit my requirements, because in a Catalyst 2900 that sentence will only control the amount of mac addresses permited for that interface or the action to take in a specific case.

But not for a group of mac addresses that is going to be in some ports.


Thanks a lot.

 

[JoelH]

You could try using the command;
port block {unicast|multicast}

on the interface.. which prevents the switch from forwarding unknown packets onto the interface. Then you would have to define MAC address in the static arp cache i suppose..

just a suggestion perhaps worth trying, i have not tried this particular command myself.

cheers

joel

 

[hexn]

What you are trying to do is possible.

First you tell the interface how many macs it can have, then you configure the macs allowed.

---------------------------------------------
int fa0/1
port security max-mac-count 2
!
mac-address-table secure 0010.A47D.AD65 fa0/1
mac-address-table secure 0010.7DE0.B56C fa0/1
---------------------------------------------

There. I specified the macs allowed on the interface, and I specified the exact macs.

Isn't that what you are trying to do?

 

[vacevedo]

What you are trying to do is possible.

First you tell the interface how many macs it can have, > then you configure the macs allowed.

---------------------------------------------
int fa0/1
port security max-mac-count 2
!
mac-address-table secure 0010.A47D.AD65 fa0/1
mac-address-table secure 0010.7DE0.B56C fa0/1
---------------------------------------------

There. I specified the macs allowed on the interface, > and I specified the exact macs.

Isn't that what you are trying to do?
----------------------------------------
This works for one group of mac addresses and one interface, the problem is I need to use the same group
on several interfaces.

Any clue ?

Thanks.

 

[hexn]

I see,

Yeah, you will have to run the same config for each interface.

 

[vacevedo]

I see,

Yeah, you will have to run the same config for each interface.

---------------------
Hi again,

the detail is, that, when you run the same configuration in another interface, this overwrites the first one.

Can this I need, be done in my 24 port Catalyst 2900 with 12.0(5.2)XU, MAINTENANCE IE, IOS version ?

Thanks.