Cisco 5510 - ASA SSL / IPsec VPN Edition User Manual

1-24
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AAA Rules for Network Access
Using MAC Addresses to Exempt Traffic from Authentication and Authorization
To use MAC addresses to exempt traffic from authentication and authorization, perform the following
steps:
Examples
The following example bypasses authentication for a single MAC address:
hostname(config)# mac-list abc permit 00a0.c95d.0282 ffff.ffff.ffff
hostname(config)# aaa mac-exempt match abc
The following example bypasses authentication for all Cisco IP Phones, which have the hardware ID
0003.E3:
hostname(config)# mac-list acd permit 0003.E300.0000 FFFF.FF00.0000
hostname(config)# aaa mac-exempt match acd
Command Purpose
Step 1
mac-list id {deny | permit} mac macmask
Example:
hostname(config)# mac-list abc permit 00a0.c95d.0282
ffff.ffff.ffff
Configures a MAC list.
The id argument is the hexadecimal number that you
assign to the MAC list. To group a set of MAC
addresses, enter the mac-list command as many
times as needed with the same ID value. Because you
can only use one MAC list for AAA exemption, be
sure that your MAC list includes all the MAC
addresses that you want to exempt. You can create
multiple MAC lists, but you can only use one at a
time.
The order of entries matters, because the packet uses
the first entry it matches, instead of a best match
scenario. If you have a permit entry, and you want to
deny an address that is allowed by the permit entry,
be sure to enter the deny entry before the permit
entry.
The mac argument specifies the source MAC address
in 12-digit hexadecimal form; that is,
nnnn.nnnn.nnnn.
The macmask argument specifies the portion of the
MAC address that should be used for matching. For
example, ffff.ffff.ffff matches the MAC address
exactly. ffff.ffff.0000 matches only the first 8 digits.
Step 2
aaa mac-exempt match id
Example:
hostname(config)# aaa mac-exempt match 1
Exempts traffic for the MAC addresses specified in a
particular MAC list.
The id argument is the string identifying the MAC
list that includes the MAC addresses whose traffic is
to be exempt from authentication and authorization.
You can only enter one instance of the aaa
mac-exempt match command.

Cisco 5510 - ASA SSL / IPsec VPN Edition Specifications

General

Brand	Cisco
Model	5510 - ASA SSL / IPsec VPN Edition
Category	Firewall
Language	English