router acl on mac address

Its only possible to filter based on MAC address for a bridge setup.

General routing does not allow you to filter based on MAC address.

Greetings,

There are at least 2 things you need to consider -

As a MAC is a Layer 2 component - 1. MAC ACL's are written in the 7xx (IE Layer 2) series numbering format (IE 701, 702, etc). 2. A router interface normally operates at Layer 3 (IE as a Routed interface). You need to operate the interface in Layer 2 mode, and one way to do that is to BRIDGE it to something else. However this can bite you as Bridging can impact on performance. You can ensure maximum throughput but linking the Bridge to a BVI to provide a routed interface and therefore maximising the Bridge performance.

Cheers................pk.

so when you say bridge do you mean I have to connect my router to another hardware device?

Bridging turns off any smarts in your router, it will just pass traffic in and push traffic right back out. Its most likely not what you are looking to do.

In general, MAC filtering isn't that useful, what are you trying to acomplish anyway?

trying to exercise some control over what machines (out there on the internet) can have access to my mail server on port 25. Filtering based on ip address is unworkable as people's ip's change all the time. What doesn't change is their mac address. I am using multiple barriers against spammers at application level but if there's anything my router can do to assist in this I want to exploit that. Someone on the cisco forum told me I could implement mac address filtering but they didn't elaborate on exactly how it's done.

You won't ever see anybody else's MAC address, thats the reason its not useful. You'll only see your own MAC address, your LAN machines, and nothing else (assuming your nexthop out is a WAN hop).

Even in a pure LAN environment (ie. a colo data center), you'd only see the next hop device MAC address and your own.

MAC addresses stay local only to your LAN, by the time the IP packets get to you, they'll only have your gateway router in them.