Would it be possible to restrict access to a device using L2 ACL on HP Comware switch which is L2 for the given VLAN?

I want to secure the access to a device on specific VLAN so it can be accessed only from specific MACs/IPs.

Can the L2 ports filter traffic based on L3 and L4 information?



Since a routed packet carries the router's MAC address as source in its frame: no, that's not possible. Layer 2 doesn't have enough information to filter L3 traffic.

However, if everything happens within the same L2 segment/VLAN you can filter out the source MACs you don't want. You'd have to include all (non-filtering) routers as they could be used to circumvent the filtering.

That being said and from your comment: many layer 2 (=non-routing) switches can also filter by layer 3 and 4 information - it depends on the specific hardware.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.