Block a Computer using Layer 3 Switch

[Shiva_B]

Hi,

We are planning to block certain devices from communicating to a different network segment or different LAN & towards internet using L3 switch / ACL & I am not good with Networking concepts to propose.

I would like to know what are all the possibilities to use this - While the IP address is Dynamic.

Is there an option to block using MAC address?

Is there a way to block a specific protocol keeping dynamic IP in mind.

Any other additional info will be highly helpful to block a computer which cannot be traced.

[Seb Rupik]

Hi there,

If you know what the MAC address is, why not create a DHCP reservation for the device, which in turn would allow you to create Layer3 ACLs.

cheers,

Seb.

[Shiva_B]

Yes. We have that plan in mind. But we want to keep the device available within the LAN.

[Seb Rupik]

A Layer3 ACL would only be applied to the interfaces routing the subnet, ie the router.

Your orginal post requested a way to filter traffic between network segments/ subnets, this would be achieved with a Layer3 ACL.

It would not interfere with intra-VLAN traffic as it is only enforced at the subnet gateways.

cheers,

Seb.

[Deepak Kumar]

Hi, 

@Seb Rupik thanks for the reply and I agree with you. I mentioned that he can apply MAC ACL in VLAN itself (VACL) and example is also showing same. 

Regards,

Deepak Kumar

[Deepak Kumar · Accepted solution]

Hi,

as you mentioned that there is DHCP server available and users are getting IP through DHCP only. I think Mac ACL is a good solution for you. 

Please read the below article:

http://cauew.blogspot.ae/2008/08/vacl-vlan-maps-mac-acl.html

Regards,

Deepak Kumar