From: Mitchell, TJ (tmitchell@allianttech.com)
Date: Wed Nov 30 2005 - 18:12:11 GMT-3
All --
According the Doc CD:
http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12225sec/3550s
cg/swacl.htm#wp1177176
there isn't a log option or extended MAC ACL's.
I think that the port-security command is the only way you are going to
get a log trapped using the restrict option with it.
Thanks
T.J. Mitchell
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
Chad Hintz
Sent: Wednesday, November 30, 2005 2:34 PM
To: Chris Lewis; El ayachi HADEK; ccie lab
Subject: RE: Port Security
Yes If it detects another mac-address it will not shutdown the port but
it will log a message. Is this possible? Also if it reboots it should
not lose the mac address entered.
Chris Lewis <chrlewiscsco@yahoo.com> wrote: I don't think there is an
option to log on MAC ACLs on a 3550.
The issue I have here is in the wording of your question. If by "and if
another is detect to continue to forward packets but log a message" you
mean it only has to forward packets from the one address you have
identified, I think your configuration is good. If it has to orward the
packets from the non-specified adress and log a message, that is a
different situation and I don't know how to do that.
Chris
Chad Hintz wrote:
I do not see a log option with mac acls on the doc cd. Am I missing
something? Brians? Scott? all the other experts???
Chris Lewis wrote: Can you share an example of using the log option with
MAC ACLs?
El ayachi HADEK wrote: violation traffic will be dropped, there is no
other choice.
http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12225sec/3550s
cg/s
wtrafc.htm#wp1038501
you can use mac acl with the logg option! try it and let me know!
-----Message d'origine-----
De : nobody@groupstudy.com [mailto:nobody@groupstudy.com]De la part de
Chad Hintz
Envoye : Wednesday, November 30, 2005 4:57 PM
A : ccie lab
Objet : Port Security
Hi All,
I have been trying to get through a port security question for a
customer
and wanted to verify my configuration.
If I wanted to setup the switch to only allow the directly connected
router's mac address to be allowed on the port and if another is detect
to
continue to forward packets but log a message. Would this be correct?
Routers' mac:000b.be90.2d72
interface GigabitEthernet0/1
switchport mode access
switchport port-security
switchport port-security violation restrict
switchport port-security mac-address 000b.be90.2d72
Thanks,
Chad
---------------------------------
Yahoo! Music Unlimited - Access over 1 million songs. Try it free.
This archive was generated by hypermail 2.1.4 : Thu Dec 01 2005 - 09:12:08 GMT-3