IR809 Router MAC Filtering

[dietrroc]

What my intentions are is to find a way to allow only a single mac address access from the IR809G LAN interface (gig1). I can't find a way to do this from the CLi show commands and information from the Internet. Any assistance is greatly appreciated.

[M02@rt37]

Hello @dietrroc,

You can use port security to restrict the number of MAC addresses on the interface.

Under interface configuration:

switchport port-security

switchport port-security maximum 1

switchport port-security mac-address <mac_address>

switchport port-security violation shutdown

Only the specified MAC address is allowed on the GigabitEthernet1 interface, and any attempts to use a different MAC address will result in the configured violation action (in this example, shutting down the port).

[dietrroc]

I appreciate your assistance, but switchport is not an option for the IR809 Router Gig interfaces. I don't see a way to accomplish this with an access list. What are my options? Thanks!

[paul driver]

Hello
I crude way would be to append a static arp entry on the rtr and acl on the interface relating to the ip address of the host.



Example host = 1.1.1.2  2222.2222.2222
rtr
arp 1.1.1.2 2222.2222.2222 ARPA

ip access-list extended arp-host
permit ip host 1.1.1.2 any

int x/x
description arp-host
ip access-group arp-host in

[dietrroc]

Thanks for all the great advice. I restricted a single host MAC access to the router using a policy map and tying the policy map to the IR809 Gig1 interface as a service policy.

class-map match-all MAC-ANY
match any
class-map match-any LAN-MAC
match source-address mac 2222.3333.4444
!
policy-map MAC-Filter
class LAN-MAC
class MAC-ANY
drop