mac access list not working

[Natalie Ramirez]

I created an extended access list and allowed a single mac address in a conference room, so only the VoIP phone will have access with a deny any any at the end.  It did not work, so I removed all permits from the list and just have a single deny any any in the access list, and have it applied to the interface on the 6509 that is in the conference room.  Still, all traffic is flowing with no disruption.

mac access-list extended phone
 deny   any any

interface GigabitEthernet2/14
 switchport
 switchport access vlan 63
 switchport mode access
 switchport voice vlan 73
 mac access-group phone in
end

I can see both the phone and the PC with:

sh mac add | inc 2/14

I can ping both the phone and the PC.  How can I stop communication on a port using a mac access-list? 

[Jon Marshall]

What version of software are you running on your 6500 ?

Jon

[Natalie Ramirez]

s3223-ipbase-mz.122-33.SXJ2.bin

[Jon Marshall · Accepted solution]

With 12.2SX mac address acls do not apply to IP traffic ie. they only work for non IP traffic.

And mac address acls can only be named acls which is why your other acl didn't work.

So you need to use an IP acl.

See this link for details -

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/vacl.html#wp1110645

Jon

[Natalie Ramirez]

I also just tried creating access list 701

access-list 701 deny 0000.0000.0000 ffff.ffff.ffff

but when I attempt to apply it to the interface, I get:

mac access-group 701 in

% Invalid access list name.

Not sure if this is a clue as to what is wrong.