I am using a Cayalyst 2960-X series Cisco Switch, Whose 2 SFPs are connecting between 2 hosts (A,B).
A,B are connected to the switch's 1,2 ports respectively. The host communicates using an l2tp based protocol. As you know l2tp is a link layer protocol.
As part of the l2tp traffic sourced at host A whose destination is B, there are few packets I want to deny from getting to port 2 / Host B.
The packets that I want to drop have a source MAC address of
88:77:66:55:44:33 in their Ethernet 2 metadata, which is part of the whole l2tp packet (see the byte layout bellow).
I would like to set a rule or an access list that drops the l2tp packet by inspecting its Ethernet 2 attribute and in case the specific
88:77:66:55:44:33 MAC address appears in the SA.
I am familiar with the
mac access-list command but every manual I had seen explicitly says that ACLs filter only
non-IP protocols. In spite of that I tried to use
mac access-list and indeed it didn't help.
Moreover, I found the Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS
Release 15.0(2)EX, and under the
Restrictions for Configuring Network Security with ACLs section it says:
You cannot apply named MAC extended ACLs to Layer 3 interfaces.
Isn't it feasible to filter ip protocols by drill down and inspecting their Ethernet 2 Mac addresses data?
By sniffing the traffic between the 2 hosts, I can tell the packets has the following byte layout (As I see on Wireshark):
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Ethernet 2 (14 Bytes) | IP(20 Bytes) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | IP |L2TP 4B|HDLC 4B| Data | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+