Cisco Router 3845 Block MAC Address

[qasimkhans8]

i am using Cisco router 3845 with  Version 15.1(4)M6. i created ACL to block the MAC-address. but i dont see mac access-group command on any interface. please help, thanks.

access-list 700 deny   38xx.xxxx.xxxx   0000.0000.0000

[Francesco Molino]

In order to apply MAC ACL, you need to create/work with bridge interface feature.

There are some examples on this forum like https://supportforums.cisco.com/discussion/10589096/mac-access-list

[qasimkhans8]

I found above link through google. but it is not clear.

[Francesco Molino]

Ok they are a lot of examples around for switches and for routers.

Switches is a little bit more easier. For routers you need to use bride-group functionnality.

Is it bridging feature that you don't understand?

If yes, you can found some documentation on CiscoLive website: https://www.ciscolive.com/online/connect/sessionDetail.ww?SESSION_ID=7917&backBtn=true

Or some blogs: http://networkerslog.blogspot.ca/2012/12/concept-of-bridge-domain-interfaces-bdi.html

You'll see it's a simple stuff to do and to understand. 

Why do you want to filter MAC addresses?

Thanks

[qasimkhans8]

BDI will not work with my current config and setup. i want to teach a lesson to bad kids dont use torrents on production environment. therefore i ll block their MAC addresses.

[Francesco Molino]

Ok got it. These guys are connected behind a switch? Not directly to the router. Why won't you block mac on switch?

If you want blocking torrent, you can also use nbar. Have you tried it? Od you want to block their network access instead of torrents? 

Do they have fix ip or dhcp?

[qasimkhans8]

i already have nbar torrent class and policy setup but it is not blocking properly.

they are getting ip through DHCP.

[Francesco Molino]

Connected through a switch in wired or wireless?

[qasimkhans8]

they are connected through switch.

[Francesco Molino]

Oh then block them by mac acl directly to the switch. If you don't want to use bridge, you need to apply mac acl on layer 2 interface. Does your router has ethernet card?

[qasimkhans8]

i already block them on switch by

mac-address-table static 38xx.xxxx.xxxx vlan 100 drop

i was curious can we block them through router?

[Francesco Molino]

If you want to block MAC on router, the only way without layer 2 interfaces is to use bridge.

If you want not to block only these guys but to manage what's going out on the internet, you can use NBAR (even if on these old routers NBAR is not updated and don't have all protocols) and also configure ZBF and if you want to have more security configure IPS (but need a module).

Doe sthis answer your question?