Reroute All Packets To/From MAC to Router First

Question

I would like to configure a switch to forward packets to/from a particular MAC address to the router first, regardless of whether the host it is connecting to is on the same switch & l3 network. This is so the traffic can pass through an inline device we have placed between the switch and router before being passed to the destination. Is there any way to configure something like this? I cannot modify the particular host itself, but I can modify the switch and inline device.

Currently my only thought is to essentially perform ARP spoofing so other hosts believe the MAC address for this particular host is a unique, non-existent MAC. We would configure the switch to send frames for this MAC towards our inline device, where we can then rewrite the MAC of the frame to the correct one on the way back to the switch. So we would be able to see all traffic headed to the particular device, but not traffic leaving it. Obviously this solution is not ideal, so any help or ideas would be greatly appreciated.

Thank you

Answer 1

Here's a few ideas:

1. Private VLAN Edge & Rerouting

There's a old feature of Cisco switches called "Private VLAN Edge" (see https://www.cisco.com/en/US/tech/tk389/tk814/tk841/tsd_technology_support_sub-protocol_home.html).

Think of it as "hotel mode", where you want to keep your guests' system from talking to each other, but everyone may talk to the router.

The feature is restricted to a single switch (or stack-of-switches), and it doesn't really work across multiple switches.

I cant' actually test this right now, but it might be worth some consideration:

• set all switchports of the given 3560G to "protected", except the port where router & inline device are connected.
• make sure that the router is re-routing incoming packets back out through the interface they came from, if source/dest are within the given subnet. There might be a performance impact, als all intra-VLAN traffic will now hairpin through the inline device and the router.

That should make all Intra-VLAN traffic visible to the device. That might be a bit more than was intended in the first place, so...

2. PVLAN Edge, Dynamic VLAN assignment & looping two VLANs

An entirely different approach might be someting along these lines:

• define two VLANs on the Switch.
• Let VLAN "A" be the regular VLAN where everyone is allowed to talk to each other and the router.
• Let VLAN "B" be the special VLAN, whose communication must go through the inline device.
• Ports of VLAN B should run as PVLAN Edge "protected" ports (except the port where the inline device is connected).
• implement a solution that maps MAC addresses from a given list to VLAN B. 802.11x, a CISCO ISE, MAB and port templates might be too steep a mountain to climb, but will help to dynamically configure ports as needed.
• Another approach might be (custom) smart port macros: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_52_se/configuration/guide/3750scg/swmacro.html#wp1238054 . The user defined port macro in question should not only set the port to "switchport access vlan B", but also as "switchport protected".
• of course, static/manual mapping of a (set of) ports to VLAN "B" works, too, but isn't as dynamic as I assume you want it to be.
• on the switch, connect the inline device's switch facing port to a *non-*protected port of VLAN B.
• on the switch, connect the inline device's router facing port to a port of VLAN A. A switching loop should not occur, as long as the inline devices' switchports are "switchport mode access" into different VLANs and without bpduguard.

Now whenever a host with a MAC-address-of-interest connects to any of the ports, it's switchport gets mapped into VLAN B, and to reach anyone else on the subnet (other MACs-of-Interest included) it must go through the inline device. MAC learning and ARPing should be "native" for all systems involved.

3. Dynamic VLAN Assignment & Auto SPAN Port

If the inline device is just intended for analyzing traffic (and not for manipulating or blocking), a custom smart port macro (see above) might just be running a user defined macro that adds another line of "monitor session 1 source interface 0/Y", as soon as a MAC address of interest is discovered on a given port. Of course, you'd need a "cleanup macro" as well, that runs after "line protocol down" of a given switch port.

4. Dynamic VLAN Assignment & SPANning one VLAN

Use a mixed approach of 2. and 3.

Port Macros assign host of interest to VLAN B. Connect both VLAN A and VLAN B to a pair of bridged ports on the router (as above, two interfaces & BVI, or better two-ports-on-switch-module & SVI).

Connect the inline device to a SPAN destination port on the switch, and use VLAN B as SPAN source. Whatever talks on VLAN B will be visible to the now passive inline device.

Cheers Marc

Answer 2

In general the way to isolate a device is to put it on it's own VLAN.

If you need to keep the IP addresses the same then you will need some clever tricks on the router. Basically on the interface facing the isolated device you need to do proxy arp for all IPs while on the interface facing the rest of the network you need to do proxy arp for the IP of the isolated device.