NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
MAC ACL for specific VLAN
I have connected four WNAP320 Access Points to a GS724TPv2 smart managed switch. The Access Points all broadcast three different SSID's (trusted, guest & IoT) that are assigned to three different VLA...
Hi Everyone,
After Eric's last question we continued by e-mail and Eric found the solution;
Please just keep config as your first setting, with all zeros in MAC mask. Then add some new rules that with Destination MAC=white list.
This is because the MAC ACL binding to VLAN not specific physical port, so the packet include upstream(Client->Server) and downstream(Server->Client). It’s necessary to add bi-direction rule.
I guess I'm not the only one who wants to build a MAC ACL white list so here's the solution to your all;
You have to make two rules per device. One with the device MAC in the destination MAC field of that rule. The second rule with the same device MAC in the source MAC field. MAC mask should be all zero's for both rules.
IN the VLAN Binding Configuration you pick the VLAN ID the devices of the white list should connect to. ACL type is MAC ACL and the ACL ID is the name you gave to the set of rules you made for your devices on the white list.
Thanks for you reply EricZ. Unfortunatly I was not succesful. What I've done;
I created a MAC ACL and added a rule for each device on my white list.
I gave every rule an unique sequence number, Action = Permit, Match Every = False, Source MAC = the device MAC, Source MAC Mask= 00:00:00:00:00:00. I was not sure about the VLAN field in the rule so I left it empty.
I skipped the MAC Binding Configuration to a specific switch port and went to the Advanced tab and selected the VLAN Binding Table. I added a VLAN Binding Configuration of the VLAN ID I want to allow my white list devices, ACL type = MAC ACL and the ACL ID the name of the MAC ACL i created in the first step.
After that every device was blocked on that VLAN. Even the ones i added in the rules.
The manual isn't all that clear to me. Guess you have to be smart to manage a smart managed switch :-)
Could you please change Source MAC MASK to FF:FF:FF:FF:FF:FF and try again?
It will be better if you can share the configuration file to us?
How do I send tech-support files from my Managed Switch to NETGEAR community moderators?
Hi Everyone,
After Eric's last question we continued by e-mail and Eric found the solution;
Please just keep config as your first setting, with all zeros in MAC mask. Then add some new rules that with Destination MAC=white list.
This is because the MAC ACL binding to VLAN not specific physical port, so the packet include upstream(Client->Server) and downstream(Server->Client). It’s necessary to add bi-direction rule.
I guess I'm not the only one who wants to build a MAC ACL white list so here's the solution to your all;
You have to make two rules per device. One with the device MAC in the destination MAC field of that rule. The second rule with the same device MAC in the source MAC field. MAC mask should be all zero's for both rules.
IN the VLAN Binding Configuration you pick the VLAN ID the devices of the white list should connect to. ACL type is MAC ACL and the ACL ID is the name you gave to the set of rules you made for your devices on the white list.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
