i created a Mac-ACL on a unch of 2960X Switches to limit user access to the internet-gateway only.
mac access-list extended PROTECTED permit any host ffff.ffff.ffff 0x800 0x0 permit any host ffff.ffff.ffff 0x806 0x0 permit any host ffff.ffff.ffff 0x86DD 0x0 permit any host dead.beef.cafe 0x800 0x0 permit any host dead.beef.cafe 0x806 0x0 permit any host dead.beef.cafe 0x86DD 0x0 deny any any
"dead.beef.cafe" is a Fortinet Firewall.
Using "switchport protected" alone was't an option because this feature is limited to one switch only. The concept of private VLANs wasn't present to me when this solution was implemented.
interface GigabitEthernet1/0/2 description Room X switchport access vlan 101 switchport voice vlan 102 switchport mode access switchport port-security maximum 3 vlan access switchport port-security switchport port-security violation protect mac access-group PROTECTED in no lldp transmit spanning-tree portfast spanning-tree bpduguard enable end
Today an issue occured with this config. All edge-ports are configured with BPDUGUARD to errdisable the ports when a STP Packet is received. The Mac-ACL acts before BPDUGUARD. So, in the situation when a loop happens between 2 switchports, the ACL is filtering BPDUs and BPDUGUARD has no effect any more.
Unfortunately i wasn't quite familar with the concept of isolated private VLANs when we implemented this network. Meanwhile i see that segmenting the network with private VLANs were a better Solution than using the Mac-ACL. I'd like to avoid redesigning the whole network just to solve this loop issue.
Any suggestions how to solve this?