Quick Reference Guide

PowerConnect B-Series TI24X Configuration Guide 181
53-1002269-02
Defining MAC address filters
7
Command syntax
Suppose you want to make port 5 a member of port-based VLAN 4, a tagged port. To do so, enter
the following.
PowerConnect(config)#vlan 4
PowerConnect(config-vlan-4)#tagged e 5
Syntax: tagged ethernet <portnum> [to <portnum> [ethernet <portnum>...]]
Defining MAC address filters
MAC layer filtering enables you to build access lists based on MAC layer headers in the
Ethernet/IEEE 802.3 frame. You can filter on the source and destination MAC addresses. The
filters apply to incoming traffic only.
You configure MAC filters globally, then apply them to individual interfaces. To apply MAC filters to
an interface, you add the filters to that interface MAC filter group.
The device takes the action associated with the first matching filter. If the packet does not match
any of the filters in the access list, the default action is to drop the packet. If you want the system
to permit traffic by default, you must specifically indicate this by making the last entry in the access
list a permit filter. An example is given below.
Syntax: mac filter <last-index-number> permit any any.
For devices running Layer 3 code, the MAC filter is applied to all inbound Ethernet packets,
including routed traffic. This includes those port associated with a virtual routing interface.
However, the filter is not applied to the virtual routing interface. It is applied to the physical port.
When you create a MAC filter, it takes effect immediately. You do not need to reset the system.
However, you do need to save the configuration to flash memory to retain the filters across system
resets.
Configuration notes and limitations
• MAC filters that have a global deny statement can cause the device to block all BPDUs. In this
case, include exception statements for control protocols in the MAC filter configuration. On
PowerConnect B-Series TI24X devices, BPDUs are not blocked by MAC filters.
The following configuration notes apply to Layer 3 devices:
• MAC filters apply to both switched and routed traffic. If a routing protocol (for example, OSPF)
is configured on an interface, the configuration must include a MAC filter rule that allows the
routing protocol MAC and the neighbor system MAC address.
• You cannot use Layer 2 filters to filter Layer 4 information.
Command syntax
To configure and apply a MAC filter, enter commands such as the following.
PowerConnect(config)#mac filter 1 deny 3565.3475.3676 ffff.0000.0000
PowerConnect(config)#mac filter 1024 permit any any
PowerConnect(config)#int e 1
PowerConnect(config-if-e10000-1)#mac filter-group 1 1024