1

I would like to configure a MAC ACL on my cisco router. From the official CISCO documentation I can see this is done by typing:

cisco# configure terminal
cisco(config) # mac access-list <mac-list-name>

However when I use this I get:

cisco(config)#mac access-list mac-Permit
                   ^
% Invalid input detected at '^' marker.

I noticed in config mode there is a command of it's own called access-list and in here I assume I can use this to configure single rules. Is this where it is supposed to be done or am I missing something? Why does the mac access-list command not work? Is it not supported on my software version.

Version: c1900-universalk9-mz.SPA.153-1.T1.bin - 15.0(1r)M16

Thanks in advanced.

  • If you ask us if something is supported in your software version, at least tell us which version you're running. – Teun Vink Dec 9 '16 at 10:43
  • @Teun Vink It is in the title... – Luke Rixson Dec 9 '16 at 10:52
  • Luke Rixson, I think what Teun Vink is saying is that we need to know what is the complete name of the IOS you are running. K9 means only that you have some encryption features. It should be something like 15.5.3M4a or something like that. Also, the IOS filename helps too (show flash). – Karl Müller Dec 9 '16 at 11:33
  • c1900-universalk9-mz.SPA.153-1.T1.bin - 15.0(1r)M16 – Luke Rixson Dec 9 '16 at 11:42
  • 2
    What are you trying to accomplish? The context these are used may be different than you think. – rnxrx Dec 9 '16 at 14:07
2

MAC access lists can be defined numerically in any standard IOS in the ranges of 1100-1199 for extended or 700-799 for basic, as such:

router(config)#access-list ?
  <1-99>            IP standard access list
  <100-199>         IP extended access list
  <1100-1199>       Extended 48-bit MAC address access list
  <1300-1999>       IP standard access list (expanded range)
  <200-299>         Protocol type-code access list
  <2000-2699>       IP extended access list (expanded range)
  <2700-2799>       MPLS access list
  <300-399>         DECnet access list
  <700-799>         48-bit MAC address access list
  compiled          Enable IP access-list compilation
  dynamic-extended  Extend the dynamic ACL absolute timer
  rate-limit        Simple rate-limit specific access list

router(config)#

So - that's how you define a mac access list. As per my comment, however, it may not behave the way you think it does. It's actually intended for use with bridging - so, for example, blocking a specific MAC address from passing through a bridge group.

It's not really analogous to the MAC filtering you might find on a consumer router in that there isn't a way to simply say "don't accept traffic from mac address x" on a standard routed interface. If you want to use IRB (see CCO Transparent Bridging Configuration Guide) you could put the IP on a BVI and then join it and one or more Ethernet interfaces into a bridge-group and then apply MAC filters via access-expressions on the physical interfaces (...thus allowing/preventing certain MAC addresses, or ranges of addresses, from making it to the BVI).

The best way to put it might actually be that the sort of MAC filtering you see on a consumer network device is actually part of the switch (..to include any integrated AP) while IP-based rules are likely part of the router. To this end - if you were using a Cisco switch then you could apply MAC filters in a pretty straightforward way via VACL's or PACL's. On a device acting as a pure router, however, it's going to be a different story.

0

I searched for the feature MAC ACL in the Cisco Feature Navigator and I found a mention to 'MAC Filtering'. After clicking the in the description of the feature, I was redirected to a document (the one mentioned before) and I didn't realize it's a document for the XE platform (my apologies).

I found, however, a document named 'Security Configuration Guide: Access Control Lists, Cisco IOS Release 15M&T', and I didn't find any mention to MAC filtering for this specific IOS. I might be wrong, but it looks like we could conclude that this IOS doesn't support it.

Take a look in the document: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/15-mt/sec-data-acl-15-mt-book.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.