Mac Access-Group - Cisco Catalyst 3550 Command Reference Manual

Chapter 2 Catalyst 3550 Switch Cisco IOS Commands

mac access-group

Use the mac access-group interface configuration command to apply a MAC access control list (ACL)
to a Layer 2 interface. Use the no form of this command to remove all MAC ACLs or the specified ACL
from the interface. You create the MAC ACL by using the mac access-list extended global
configuration command.
Syntax Description name
in
Defaults
No MAC ACL is applied to the interface.
Command Modes Interface configuration (Layer 2 interfaces only)
Command History Release
12.1(9)EA1
Usage Guidelines
You can apply MAC ACLs only to ingress Layer 2 interfaces. You cannot apply MAC ACLs to Layer
3 interfaces.
On Layer 2 interfaces, you can filter IP traffic by using IP access lists and non-IP traffic by using MAC
access lists. You can filter both IP and non-IP traffic on the same Layer 2 interface by applying both an
IP ACL and a MAC ACL to the interface.
You cannot apply more than one MAC ACL to a Layer 2 interface. If a MAC ACL is already configured
on a Layer 2 interface and you apply a new MAC ACL to the interface, the new ACL replaces the
previously configured one.
You cannot apply a MAC ACL (or IP ACL) to a Layer 2 interface on a switch that has an input Layer 3
ACL or a VLAN map applied to it. If a switch has a MAC ACL or IP ACL applied to a Layer 2 interface,
you cannot apply an IP ACL to an input Layer 3 interface on that switch, and you cannot apply a VLAN
map to any of the switch VLANs.
When an inbound packet is received on an interface with a MAC ACL applied, the switch checks the
match conditions in the ACL. If the conditions are matched, the switch forwards or drops the packet,
according to the ACL action.
If the specified ACL does not exist, the switch forwards all packets.
For more information about configuring MAC extended ACLs, see the "Configuring Network Security
Note
with ACLs" chapter in the software configuration guide for this release.
OL-8566-02
mac access-group {name} in
no mac access-group [name]
Specify a named MAC access list.
Specify that the ACL is applied in the ingress direction. Outbound ACLs are
not supported on Layer 2 interfaces.
Modification
This command was introduced.
Catalyst 3550 Multilayer Switch Command Reference
mac access-group
2-213