SUMMARY STEPS
1.
enable
2.
configure terminal
3.
mac access-list extended name
4.
{deny | permit} {any | host source MAC address | source MAC address mask} {any | host destination
MAC address | destination MAC address mask} [type mask | lsap lsap mask | aarp | amber | dec-spanning
| decnet-iv | diagnostic | dsm | etype-6000 | etype-8042 | lat | lavc-sca | mop-console | mop-dump |
msdos | mumps | netbios | vines-echo | vines-ip | xns-idp | 0-65535] [cos cos]
5.
end
6.
show running-config
7.
copy running-config startup-config
DETAILED STEPS
PurposeCommand or Action
Enables privileged EXEC mode. Enter your password if prompted.enable
Example:
Switch> enable
Step 1
Enters the global configuration mode.configure terminal
Example:
Switch# configure terminal
Step 2
Defines an extended MAC access list using a name.
mac access-list extended name
Example:
Switch(config)# mac access-list extended mac1
Step 3
In extended MAC access-list configuration mode, specifies to
permit or deny any source MAC address, a source MAC address
{deny | permit} {any | host source MAC address |
source MAC address mask} {any | host destination
Step 4
with a mask, or a specific host source MAC address and any
MAC address | destination MAC address mask} [type
destination MAC address, destination MAC address with a mask,
or a specific destination MAC address.
mask | lsap lsap mask | aarp | amber | dec-spanning
| decnet-iv | diagnostic | dsm | etype-6000 |
etype-8042 | lat | lavc-sca | mop-console |
(Optional) You can also enter these options:
mop-dump | msdos | mumps | netbios | vines-echo
| vines-ip | xns-idp | 0-65535] [cos cos]
• type mask—An arbitrary EtherType number of a packet with
Ethernet II or SNAP encapsulation in decimal, hexadecimal,
Example:
Switch(config-ext-macl)# deny any any
or octal with optional mask of don’t care bits applied to the
EtherType before testing for a match.
Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX
OL-29048-01 169
Configuring IPv4 ACLs
Creating Named MAC Extended ACLs