Configuring MAC-based ACLs

---

You can configure MAC-based ACL entries to permit or deny network traffic based on a number of parameters:

• Source MAC address
• Source MAC address mask
• Destination MAC address
• Destination MAC address mask
• EtherType value
• Name of the vNET
• Bridge domain name
• VLAN number
• Switch port number

These capabilities enable various common use cases as exemplified in the following sections.

Configuring a MAC-based ACL to Deny Network Traffic

 

Figure 12-2 below shows the example of a server MAC address and Ethertype (IPv4) that you want to block when the traffic is ingressing a switch:

 

Figure 15-3 - MAC ACL Blocking Access

  

To deny IPv4 network traffic from MAC address, 01:80:c2:00:00:0X, for the scope fabric, create the MAC ACL, deny-MAC, using the following syntax:

 

CLI (network-admin@switch) > acl-mac-create name deny-mac action deny src-mac 01:80:c2:00:00:0X ether-type ipv4

 scope fabric

 

To review the configuration, use the acl-mac-show command:

 

CLI (network-admin@switch) >acl-mac-show name deny-mac layout vertical

 

name:                        deny-mac

id:                          b000015:12

action:                      deny

src-mac:                     01:80:c2:00:00:0X

dst-mac:                     00:00:00:00:00:00

dst-mac-mask:                aa:aa:aa:aa:aa:aa

ether-type:                  ipv4

vlan:                        0

scope:                       fabric

port:                        0

 

Configuring a MAC-based ACL to Permit Network Traffic

In addition to the deny action, it is also possible to permit network traffic by using Layer 2 parameters, as shown in the example below:

 

Figure 15-4 - MAC ACL Allowing Access 

 

To permit IPv4 network traffic from MAC address 01:80:c2:00:00:0X, create a MAC-based ACL using the following syntax:

 

CLI (network-admin@switch) >  acl-mac-create name allow-mac action permit src-mac 01:80:c2:00:00:0X ether-type ipv4 scope fabric

 

To review the configuration, use the acl-mac-show command:

 

CLI (network-admin@switch) >  acl-mac-show name deny-mac layout vertical

 

name:                        deny-mac

id:                          b000015:12

action:                      deny

src-mac:                     01:80:c2:00:00:0X

dst-mac:                     00:00:00:00:00:00

dst-mac-mask:                aa:aa:aa:aa:aa:aa

ether-type:                  ipv4

vlan:                        0

scope:                       fabric

port:                        0

 

To delete the ACL configuration, use the acl-mac-delete command.

To modify the ACL configuration, use the acl-mac-modify command.