Block internet access on a 1921 router using the mac address

[cyberhunt]

How can I block someone's internet access using the mac address, I only want to block internet access and let all other traffic pass through. Or can I use some sort of a ACL.

Thank you in advance.

[Seb Rupik]

Hi there,

You can't use a Layer2 address as a component in a Layer3 ACL.

Your best option is to create a DHCP reservation for the MAC address, and create a Layer3 ACL to block internet access for that IP address.

Combine this with DHCP snooping and DAI to stop the user(s) from manually setting their IP addresses to circumvent your ACL.

cheers,

Seb.

[cyberhunt]

Hi,

Can you maybe tell me how to do that, everything you mention.

I also do have a layer3 switch where everything connects to and my switch connect to my router who receive the internet connection and distribute it to my network.

[Seb Rupik]

It is easier to setup DHCP reservations using a proper DHCP server than a router but the STATIC pool method below should work.

The below has been thoroughly tested in notepad, so your millage may vary!:

!! ROUTER
!
ip dhcp pool LAN01
  network 192.168.1.0 255.255.255.0
  domain-name example.com
  default-router 192.168.1.254
!
ip dhcp pool STATIC
  host 192.168.1.100
  hardware-address aaaa.bbbb.cccc
  host 192.168.1.101
  hardware-address dddd.eeee.ffff
!
ip dhcp excluded-address 192.168.1.254
!
ip access-list ext BLOCK_TO_INTERNET
  ip deny host 192.168.1.100 any
  ip deny host 192.168.1.101 any
!
int gi0/0
  desc TO_THE_INTERNET
  ip access-group BLOCK_TO_INTERNET out
!
int gi0/1
  desc TO_THE_SWITCH
  no shut
!
int gi0/1.10
  encap dot1q 10
  ip address 192.168.1.254 255.255.255.0
!

!! SWITCH
!
vlan 10
  name LAN01
!
ip dhcp snooping
ip dhcp snooping vlan 10
!
int gi0/1
  desc TO_THE_ROUTER
  switchport mode trunk
  switchport trunk allowed vlan 10
  ip dhcp snooping trust
!
int gi0/2
  desc USER_PORT
  switchport mode access
  switchport access vlan 10
  spanning-tree portfast
  ip verify source
!

Please share the config of your router to get a better fit.

cheers,

Seb.

[Deepak Kumar]

Hi,

I want to add something which is missing in the ACL configuration as

ip access-list ext BLOCK_TO_INTERNET
 5 ip deny host 192.168.1.100 any
 6 ip deny host 192.168.1.101 any
100 Permit ip any any

Regards,

Deepak Kumar

[Seb Rupik]

aye @Deepak Kumar , right you are! ;)

[Deepak Kumar]

Hi,

First, share your network topology. Based on the topology I can guide you that you can block internet access or not. 

Regards,

Deepak Kumar