Filter hosts on a specific MAC using the Routing Method

Question 1: "How do I configure a vro to filter out the traffic of a specific mac address? You do not want the host with this mac address to go through the router !".

The requirements for this issue are fresh. When you filter a MAC address, this action takes place on the second layer. Vrouters generally perform layer-3 routing tasks. They only filter the MAC addresses that enter when bridging in rare cases, therefore, it is best to set such filtering on a L2 switching device.

Method 1: But this requirement is not impossible for the router. The following configuration has been used to achieve the required results:

Ip cef // Rate-limit requires cef support, and the router may not enable cef by default.
Interface Ethernet0/0
Ip address 192.168.1.254 255.255.255.0
Rate-limit input access-group rate-limit 100 8000 1500 2000 conform-action drop exceed-action drop
// If the source MAC address is a specified value, it is discarded (all others are allowed)
Access-list rate-limit 100 0001.0001.abcd // the MAC address to be restricted

At this time, you must note that the target workstation cannot pass through other three-tier devices until it reaches the vro; otherwise, the MAC address will be changed.

Question 2: "My router is Cisco 1720 and does not support CEF. What should I do ?"

The Cisco 1720 vro can support CEF, but requires software of 12.0 (3) T and later ip plus versions. Software of standard IP version 12.2 (11) YV can also support CEF. If the current IOS software version of the router is not enough, You need to upgrade it.

Method 2: You can also use the bridge (IRB) method to solve the problem. This method only requires 12.0 (2) TB or higher standard IP version software. The configuration is as follows:

Bridge irb // enable IRB support
Interface Ethernet0/0
No ip address // route to logical port BVI 1
Bridge-group 1 // join bridge group 1
!
Interface BVI1
Ip address 192.168.1.254 255.255.255.0 // provides a route for the Bridge Group 1
!
Bridge 1 protocol ieee // run the Spanning Tree protocol to Prevent Loops
Bridge 1 route ip // route IP traffic
Bridge 1 address 0001.0001.abcd discard // discard the packet from MAC address 0001.0001.abcd

Article entry: csh responsible editor: csh