Brocade TurboIron 24X Series Configuration Guide - Manual (Page 295)

Brocade TurboIron 24X Series Configuration Guide 261
53-1003053-01
Defining MAC address filters
You configure MAC filters globally, then apply them to individual interfaces. To apply MAC filters to
an interface, you add the filters to that interface MAC filter group.
The device takes the action associated with the first matching filter. If the packet does not match
any of the filters in the access list, the default action is to drop the packet. If you want the system
to permit traffic by default, you must specifically indicate this by making the last entry in the access
list a permit filter. An example is given below.
Syntax: mac filter <last-index-number> permit any any.
For devices running Layer 3 code, the MAC filter is applied to all inbound Ethernet packets,
including routed traffic. This includes those port associated with a virtual routing interface.
However, the filter is not applied to the virtual routing interface. It is applied to the physical port.
When you create a MAC filter, it takes effect immediately. You do not need to reset the system.
However, you do need to save the configuration to flash memory to retain the filters across system
resets.
Configuration notes and limitations
• MAC filters that have a global deny statement can cause the device to block all BPDUs. In this
case, include exception statements for control protocols in the MAC filter configuration. BPDUs
are not blocked by MAC filters.
The following configuration notes apply to Layer 3 devices:
• MAC filters apply to both switched and routed traffic. If a routing protocol (for example, OSPF)
is configured on an interface, the configuration must include a MAC filter rule that allows the
routing protocol MAC and the neighbor system MAC address.
• You cannot use Layer 2 filters to filter Layer 4 information.
Command syntax
To configure and apply a MAC filter, enter commands such as the following.
TurboIron(config)#mac filter 1 deny 0000.0075.3676 ffff.0000.0000
TurboIron(config)#mac filter 1024 permit any any
TurboIron(config)#int e 1
TurboIron(config-if-e10000-1)#mac filter-group 1 1024
These commands configure a filter to deny traffic with a source MAC address that begins with
“3565” to any destination. The second filter permits all traffic that is not denied by another filter.
NOTE
Once you apply a MAC filter to a port, the device drops all Ethernet traffic on the port that does not
match a MAC permit filter on the port.
Syntax: [no] mac filter <filter-num> permit | deny <src-mac> <mask> | any <dest-mac> <mask |
any
The permit | deny argument determines the action the software takes when a match occurs.