To block specific Mac-Address using port security

[fjmendonca]

I need to configure Port Security in the Catalyst 2950G-48, however instead of specifying the Mac-Address that must to access the network, I need to allow all the Mac-Address with exception of one specific.

With CatOS the command is:

set cam static | permanent filter unicast_mac vlan

But with IOS I don´t found the simular command.

[oj88]

You can use mac-address acl

http://www.cisco.com/en/US/partner/products/hw/switches/ps628/products_command_reference_chapter09186a008007eebc.html#xtocid26

[fjmendonca]

But if I to use mac-address acl applied in all interfaces of the switch, the CPU utilization can be very high?

[Georg Pauwen]

Hello,

MAC address ACL's are for non-IP traffic only, not sure if that is what you want.

If you have an unused port on your switch, you could blackhole traffic for that MAC address:

mac-address-table static 0020.1223.e3f4 interface GigabitEthernet0/2

Since static entries take precedence over dynamic entries, all traffic for that MAC address wil effectively be dropped. In that example, interface GigabitEthernet0/2 would be your unused interface, the MAC address used here is obviously just an example...

Regards,

GP

[fjmendonca]

Would I like to know if I use mac-address acl or mac-address-table static the memory and CPU utilization increase considerably?

[amit-singh · Accepted solution]

If you use MAC ACL, yes it will increase the CPU utilization as it will be software processed. Static Mac-entry will not cause much effect on CPU.

MAC acl will not be of much use as it block only the non-ip traffic as suggested by Greg in his last post. use the other method listed by Greg.

regards,

-amit singh