2

i created a Mac-ACL on a unch of 2960X Switches to limit user access to the internet-gateway only.

mac access-list extended PROTECTED
 permit any host ffff.ffff.ffff 0x800 0x0
 permit any host ffff.ffff.ffff 0x806 0x0
 permit any host ffff.ffff.ffff 0x86DD 0x0
 permit any host dead.beef.cafe 0x800 0x0
 permit any host dead.beef.cafe 0x806 0x0
 permit any host dead.beef.cafe 0x86DD 0x0
deny   any any

"dead.beef.cafe" is a Fortinet Firewall.

Using "switchport protected" alone was't an option because this feature is limited to one switch only. The concept of private VLANs wasn't present to me when this solution was implemented.

interface GigabitEthernet1/0/2
  description Room X
  switchport access vlan 101
  switchport voice vlan 102
  switchport mode access
  switchport port-security maximum 3 vlan access
  switchport port-security
  switchport port-security violation protect
  mac access-group PROTECTED in
  no lldp transmit
  spanning-tree portfast
  spanning-tree bpduguard enable
 end

Today an issue occured with this config. All edge-ports are configured with BPDUGUARD to errdisable the ports when a STP Packet is received. The Mac-ACL acts before BPDUGUARD. So, in the situation when a loop happens between 2 switchports, the ACL is filtering BPDUs and BPDUGUARD has no effect any more.

Unfortunately i wasn't quite familar with the concept of isolated private VLANs when we implemented this network. Meanwhile i see that segmenting the network with private VLANs were a better Solution than using the Mac-ACL. I'd like to avoid redesigning the whole network just to solve this loop issue.

Any suggestions how to solve this?

Regards Andreas

Improve this question
2
  • You need to allow the MAC addresses used for link-local protocols (OUI 01-80-C2). I think this is a case of using the correct tool for the job. If you buy a bunch of nails and a screwdriver, you will have a hard time driving the nails with the screwdriver. You need to go back to the store and either get screws or a hammer, rather than ask how to drive the nails with the screwdriver.
    – Ron Maupin ♦
    Commented Oct 25, 2016 at 20:49
  • Yes i know, but as a service provider my customer has to pay me (or my company) to buy a hammer. My customer doesn't care if i drive the nails with an screwdriver, because the screwdriver and the nails are already payed ..... ;)
    – Andreas Schaefer
    Commented Nov 8, 2016 at 22:14

1 Answer 1

Reset to default
1

You should never block the OUI (01-80-C2) for the layer-2, link-local protocols. That OUI is set aside for the link-layer protocols like LLDP, BPDUs, 802.1X etc. It is a multicast OUI, and bridges (including switches) that follow the IEEE 802.1D (Spanning Tree) standard will never send those frames to another interface.

If you are using PVST, then the BPDUs use a different MAC address: 01:00:0C:CC:CC:CD.

Improve this answer
1
  • yes, i solved the Problem already this way. THX!
    – Andreas Schaefer
    Commented Nov 8, 2016 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.