Binding a Cisco MAC address to an IP address

There are three solutions available in Cisco. solution 1 and solution 2 provide the same functionality, that is, bind the MAC address Nic hardware address of the specific host to the specific switch port). solution 3 is to bind the MAC address Nic hardware address of the specific host to the specific switch port at the same time) and IP address.
1. solution 1-Port-based MAC Address binding

Take the Cisco 2950 vswitch as an example. log on to the vswitch and enter the management password to enter the configuration mode. Then, run the following command:

Ng = 1 cellPadding = 0 width = "80%" align = left bgColor = # cccccc border = 0> Switch # config terminal # enter the Configuration Mode
Switch (config) # Interface fastethernet 0/1 # enter the specific port configuration mode
Switch (config-if) # Switchport port-secruity # Configure port security mode
Switch (config-if) switchport port-security mac-address MAC (MAC address of the host)
# Configure the MAC address of the host to which the port is bound
Switch (config-if) no switchport port-security mac-address MAC (MAC address of the host)
# Delete the MAC address of the bound host

Note: The preceding command sets a port on the vswitch to bind a specific MAC address so that only the host can use the network, if the NIC of the host is changed or another PC wants to use the network via this port, it will not be available unless the MAC address bound to the port is deleted or modified.

Note: The above functions are applicable to Cisco 2950, 3550, 4500, and 6500 series switches.

2. solution 2-Expanded access list based on MAC address

Switch (config) Mac access-list extended MAC10
# Define a MAC address access control list and name it MAC10
Switch (config) permit host 0009.6bc4.d4bf any
# A host with the MAC address 0009.6bc4.d4bf can access any host
Switch (config) permit any host 0009.6bc4.d4bf
# Define that all hosts can access hosts whose MAC address is 0009.6bc4.d4bf
Switch (config-if) interface Fa0/20 # enter the specific port configuration mode
Switch (config-if) mac access-group MAC10 in
# Apply the access list named MAC10 on this port, that is, the access policy we defined earlier)
Switch (config) no mac access-list extended MAC10
# Clear the access list named MAC10

This function is the same as the application, but it is a port-based MAC Address Access Control List restriction that can limit the MAC address and target address range of a specific source.

Note: The above functions can be implemented on Cisco 2950, 3550, 4500, and 6500 series switches, but note that 2950 and 3550 require the switch to run the Enhanced software Image Enhanced Image ).

3. scheme 3--bind the MAC address of the IP address

You can only use application 1 or 2 in combination with an IP-based Access Control List for IP-MAC binding.

Switch (config) Mac access-list extended MAC10
# Define a MAC address access control list and name it MAC10
Switch (config) permit host 0009.6bc4.d4bf any
# A host with the MAC address 0009.6bc4.d4bf can access any host
Switch (config) permit any host 0009.6bc4.d4bf
# Define that all hosts can access hosts whose MAC address is 0009.6bc4.d4bf
Switch (config) Ip access-list extended IP10
# Define an IP address access control list and name it IP10
Switch (config) Permit 192.168.0.1 0.0.0.0 any
# A host with a defined IP address of 192.168.0.1 can access any host
Switch (config) Permit any 192.168.0.1 0.0.0.0
# Define that all hosts can access hosts whose IP address is 192.168.0.1
Switch (config-if) interface Fa0/20
# Enter the specific port configuration mode
Switch (config-if) mac access-group MAC10 in
# Apply the access list named MAC10 on this port, that is, the access policy we defined earlier)
Switch (config-if) Ip access-group IP10 in
# Apply the access list named IP10 on this port, that is, the access policy we defined earlier)
Switch (config) no mac access-list extended MAC10
# Clear the access list named MAC10
Switch (config) no Ip access-group IP10 in
# Clear the access list named IP10

The Application 1 mentioned above is based on the binding of the host MAC address and the switch port. solution 2 is the access control list based on the MAC address. The functions of the first two solutions are roughly the same. If you want to bind an IP address to a MAC address, you can bind solution 1 or solution 2 to the IP address access control list as needed to achieve the desired effect.

Note: The above functions can be implemented on Cisco 2950, 3550, 4500, and 6500 series switches, but note that 2950 and 3550 require the switch to run the Enhanced software Image Enhanced Image ).