ACLs....if you write a permit rule for each of the MAC addresses, followed by a deny all, wouldn't that work??
permit any
permit any
Permit any
Deny any any
Second option....if you want to esnure that only the tree MAC addresses wil be allowed on ports 1,3 and 5, then you should be able to use Port Security.
This allows you to either learn the addresses on the ports, which you then lock, or statically configure the MAC addresses; you can choose to discard any non-compliant traffic, or shutdown the port.
Have a look at page 273 of the User Guide.
Third, , but more complex method, is to use MAC address authentication tied with authentication using RADIUS to a directory service....
The problem is, so far, that when I use 1 MAC address on port 1, I cannot assign the same MAC address also to port 2 and 3
MAC 1 must have access on port 1, 3, 5,
MAC 2 must have access on port 1, 3, 5,
MAC 3 must have access on port 1, 3, 5,
I'm afraid I have to use Radius, but I know even less about Radius than I know about the 35xx
Your second option I've use on another of our 35xx switches, and that works fine. Multiple MAC's only access through that port, or just one MAC is allowed om that specific port.
I'll try the suggested ACL as soon as possible.......
Where the Set Port is unlocked, then you have Limited Dynamic Lock chosen for a max of 3. It looks like this would allow the port to learn 3 addresses then lock. You would physically connect the three devices to each port and then it should not allow another addresses beyond the first three.
cerbera_a84f2d
176 Posts
0
October 17th, 2012 12:00
ACLs....if you write a permit rule for each of the MAC addresses, followed by a deny all, wouldn't that work??
permit any
permit any
Permit any
Deny any any
Second option....if you want to esnure that only the tree MAC addresses wil be allowed on ports 1,3 and 5, then you should be able to use Port Security.
This allows you to either learn the addresses on the ports, which you then lock, or statically configure the MAC addresses; you can choose to discard any non-compliant traffic, or shutdown the port.
Have a look at page 273 of the User Guide.
Third, , but more complex method, is to use MAC address authentication tied with authentication using RADIUS to a directory service....
HansCX500
3 Posts
0
October 17th, 2012 15:00
The problem is, so far, that when I use 1 MAC address on port 1, I cannot assign the same MAC address also to port 2 and 3
MAC 1 must have access on port 1, 3, 5,
MAC 2 must have access on port 1, 3, 5,
MAC 3 must have access on port 1, 3, 5,
I'm afraid I have to use Radius, but I know even less about Radius than I know about the 35xx
Your second option I've use on another of our 35xx switches, and that works fine. Multiple MAC's only access through that port, or just one MAC is allowed om that specific port.
I'll try the suggested ACL as soon as possible.......
Hans
DELL-Willy M
802 Posts
0
October 18th, 2012 13:00
Have you tried using this set up from the GUI?
Where the Set Port is unlocked, then you have Limited Dynamic Lock chosen for a max of 3. It looks like this would allow the port to learn 3 addresses then lock. You would physically connect the three devices to each port and then it should not allow another addresses beyond the first three.
Hope this helps,
Keep us updated if you can.
HansCX500
3 Posts
0
October 31st, 2012 10:00
Sorry for the late answer, there more than just switches....
The solution with the Limited Dynamic Lock did not work.
Cerbera put me in the right direction
I have tried again to build an ACL
Command line:
configure
mac access-list note1
permit 00:01:01:01:01:01 ff:ff:ff:ff:ff:ff any
permit 00:02:02:02:02:02 ff:ff:ff:ff:ff:ff any
deny any any
end
This ACL I bind to a port e1 and to port e2
All traffic, other than the two MAc adresses is blocked.
And it will work for 3 MAC adressen too.
Then I tried to copy the same procedure to a 34xx..... just to find out that that switch does not have a 'permit' option.
Back to square 1
Hans
DELL-Willy M
802 Posts
0
October 31st, 2012 11:00
Looks like the default config for Mac ACLs on the 34xx is permit all. I pulled this out of the User Guide page 91,92
http://support.dell.com/support/edocs/network/pc34xx/en/cli/pdf/CarrierCLI.zip
ACL Commands mac access-list
The mac access-list Global Configuration mode command creates Layer 2 ACLs. To delete an
ACL, use the no form of this command.
Syntax
mac access-list name
no mac access-list name
• name—Specifies the name of the ACL.
Default Configuration
The default for all ACLs is permit all.