Lock the Benches — Block Unmanaged Devices with a MAC ACL

N10-009 4.3 APNET 3.5.A APNET 3.5.C APNET 4.3

Console — bench-sw7 (simulated)

bench-sw7>

Scenario & Tasks

You volunteer as the network steward for the Cedar Loop Makerspace. People keep plugging personal streaming sticks and smart speakers into the open lab benches, hogging bandwidth and dodging the captive portal. You have a roster of the offending devices by vendor (the first three octets of their MAC — the OUI). Build a Layer 2 MAC ACL on bench-sw7 that denies those vendors, bind it inbound on the bench access ports, and save it so it survives a reboot.

  • Create an extended MAC access list named BenchGuard. Tip: mac access-list extended BenchGuard
  • Add a deny entry for each of the six rogue vendor OUIs (see roster), masking the lower 24 bits so any device from that vendor is matched. Form: deny <mac> 0000.00ff.ffff any
  • Bind BenchGuard inbound on every bench port: g1/0/5 through g1/0/16. Tip: interface range g1/0/5 - 16, then mac access-group BenchGuard in
  • Save to the startup configuration so the rules persist. Tip: copy running-config startup-config

Rogue device roster (block these vendors):

#Vendor (in-scenario)MAC / OUIMask
Command reference (this simulated CLI)
enable — enter privileged mode
configure terminal (or conf t) — global config
mac access-list extended NAME — create / edit a MAC ACL
  deny <mac> <mask> any — deny entry (mask wildcards bits to ignore)
interface range g1/0/5 - 16 — select a port range
  mac access-group NAME in — bind ACL inbound on selected ports
show mac access-list · show running-config
copy running-config startup-config (or write memory) — save
exit — leave current mode · end — back to privileged · ? — help

Check Your Understanding

Score: 0 / 7