4

I am using a MAC access list on this switch, so I go about it by first creating the MAC access list:

#conf t
#mac access-list extended aclname
# permit host XXXX.XXXX.XXXX any

Then, I tie this list to all/one port:

#conf t
#interface gigabit 1/0/Y
# mac access-group aclname in

So, any traffic coming towards port Y gets checked against the MAC access list, to check if the source is allowed to enter.

Then i do a #clear mac address-table dynamic

I have done this to many site offices, but there is this particular site which has about 80+ devices that is driving me crazy, this site has a larger number of devices than the rest sites. So everytime i add a mac, another device gets disconnected.

I guess my question is: Is there any limitation on this access list? How many? How do you propose I overcome this?

Improve this question
0

1 Answer 1

Reset to default
3

It sounds like you are running out of the limited TCAM space. You could change the SDM. If you are not using this as a layer-3 switch with routing, you could use the sdm prefer access command to increase the TCAM space for ACLs. This command requires you to reload the switch for it to take effect.

This seems like a lot of work for little to no gain. It is very simple to spoof or change a MAC address in a host. Trying to restrict access based on MAC addresses is a fool's game. Anyone could waltz in there and clone a MAC address for his device to connect to your network. There are much better ways to do this. See this question, its comments, and its answers. There are also other question and answer on this site if you search.

Improve this answer
3
  • Thank you Ron, this is what i am looking for! I wonder if sdm prefer access is better than sdm prefer vlan? What do you think?
    – HQJ
    Oct 27, 2016 at 20:57
  • Either should give you more TCAM space. It depends on your needs.
    – Ron Maupin ♦
    Oct 27, 2016 at 21:02
  • You have been extremely helpful, thank you very much good human being
    – HQJ
    Oct 27, 2016 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.