This document explains MAC filtering. It includes the following sections:

About MAC Filtering

Note: MAC filtering is allowed on tunnel traffic.

• Processed - Packets are permitted to pass through the bridge unaffected.

• Filtered - Packets are not permitted to pass through the bridge.

• Tagged - Packets are allowed to pass through the bridge but are marked with a number in the range of 1 to 64 based on a configurable parameter.

• Filter-item - A single rule for the address field of a packet. The result is either TRUE (the match was successful) or FALSE (the match was not successful).

• Filter-list - Contains a list of one or more filter-items.

• Filter - Contains a set of filter-lists.

To set up a filter for LLC, use the Bridge Net as the interface number for the filter. Calculate the Bridge Net number by adding two to the number of interfaces configured for your router. Enter list devices at the Config> prompt or enter configuration at the Monitor> prompt to see a list of interfaces.

In the following example the Bridge Net number is 6.

Config>list devices
Ifc 0    slot 0  port 0     Ethernet 
Ifc 1    slot 1  port 0     Token Ring 
Ifc 2    slot 1  port 1     Token Ring 
Ifc 3    slot 2  port 0     Quad/Twin Serial Line 
Ifc 4    slot 2  port 1     Quad/Twin Serial Line 

Using MAC Filtering Parameters

• Source MAC address or destination MAC address

• Mask to be applied to the packet's fields to be filtered

• Interface number

• Input/output designation

• Include/exclude/tag designation

• Tag value (if you designated a tag)

• Address Type: source or destination

• Tag: Tag-value

• Address Mask: Hex-Mask

The address mask is a MAC address in hex comparing the packet's addresses. The mask is applied to the source or destination MAC address of the packet before comparing it against the specified MAC address.

The mask specifies the bytes that are to be logically ANDed with the bytes in the MAC address. It must be of equal length to the specified MAC address. If no mask is specified, it is assumed to be all 1's.

Filter List Parameters

• Name: ASCII-string

• Filter-Item List: filter-item1, ..., filter-item

• Action: INCLUDE, EXCLUDE, TAG(n)

Applying a filter list to a packet consists of comparing each filter item in the order by which the filter items were added to the list. If any of the filter items in the list return TRUE then the filter list returns its designated action.

Filter Parameters

• Filter list Names: ASCII-string, ..., ASCII-string

• Interface Number: IFC-number

• Port Direction: input or output

• Default Action: include, exclude, or tag

• Default Tag: tag value

When a filter evaluates a packet to an include condition, the packet is forwarded. When a filter evaluates a packet to an exclude condition, the packet is dropped. When a filter evaluates to a tag condition, the packet being considered is forwarded with a tag.

An additional parameter of each filter is the default action which is the result of non-match for all of its filter lists. This default action is include. It can be set to either include, exclude, or tag. In addition, if the default action is tag, a tag value is also given.

Using MAC Filtering Tags

• MAC Address filtering is handled by a joint effort between Bandwidth Reservation and the MAC Filtering feature (MCF) using tags. A user with bandwidth reservation is able to categorize bridge traffic, for example, by assigning a tag to it.

• Tagging is done by creating a filter item at the MAC filtering configuration prompt and assigning a tag to it. This tag is used to set up a bandwidth class for all packets associated with this tag. Tag values must be in the range of 1 to 64.

  OpenROUTE software supports applying tags only to bridged packets and allows only the MAC address fields of the packet to be used in applying the tag.

• Up to five tagged MAC addresses can be set from 1 to 5. TAG1 is searched for first, then TAG2, and so on.

• Once a tagged filter is created, it is assigned a class and priority in the Bandwidth Reservation configuration process. Use tag at the Bandwidth Reservation to reference the tag.

Accessing the MAC Filtering Prompts

Config> feature mcf
MAC Filtering user configuration
Filter config>

Monitor> feature mcf
MAC Filtering user console
Filter>

Not all parameters apply to all router platforms. Press Space twice after you type a command to display the available parameters for each command for your router. Enter help for information about using the command line interface.

[C] means the command is available at the Filter config> prompt.

[M] means the command is available at the Filter> prompt.

Table 1 MAC Filtering Commands

Command	Function
Attach [C]	Adds a filter list to a filter.
Clear [M]	Clears the per filter statistics listed in the list filter command.
Create [C]	Creates a filter list or an input or output filter.
Default [C]	Sets the default action for the filter with a specified filter-number to exclude, include, or tag.
Delete [C]	Removes all information associated with a filter list and frees an assigned string as a name for a new filter list. Also deletes a filter created.
Detach [C]	Deletes a filter-list name from a filter.
Disable [C] [M]	Disables MAC filtering globally or on a per filter basis.
Enable [C] [M]	Enables MAC filtering globally or on a per filter basis.
Exit [C] [M]	Exits the MAC filtering configuration or monitoring process.
List [C] [M]	Lists a summary of statistics and settings for each filter currently running in the router.
Move [C]	Reorders the filter-lists attached to a specified filter.
Reinit [C] [M]	Re-initializes the entire MAC filtering system without affecting the rest of the router.
Set-Cache [C]	Changes the cache size for a filter.
Update [C]	Adds or deletes information from a filter-list. Brings you to a menu of appropriate subcommands.

Attach [C]

Syntax: attach filter-list-name filter-number

Enter a filter-list name []? atm_list
Enter a filter number [1]? 3

The command also clears the per filter statistics listed in the list filter command for the filter associated with the filter-number plus all the statistics listed for each filter list in this filter.

Syntax: clear

all

filter

Example: clear all

filter filter-number

Example: clear filter 6

Create [C]

Syntax: create

list

filter

Example: create list newyork

filter input/output interface-number

Example: create filter input 2

Default [C]

Syntax: default

exclude

include

tag

Example: default exclude 3

include filter-number

Example: default include 3

tag tag-number filter-number

Example: default tag 3 15

Delete [C]

This command also deletes a filter created using the create filter command.

Syntax: delete

list

filter

If the filter-list is attached to a filter that has already been created, then this command displays an error messageen without deleting anything. All filter-items belonging to this list are also deleted when this command is used.

Example: delete list newyork

filter filter-number

Example: delete 3

Detach [C]

Syntax: detach list

Disable [C] [M]

Syntax: disable

all

filter

Example: disable all

filter filter-number

Example: disable filter

Enter a filter number [1]? 3

Syntax: enable

all

filter

Example: enable all

filter filter-number

Example: enable filter

Enter a filter number [1]? 3

Syntax: exit

List [C] [M]

• Whether or not filtering is enabled or disabled

• A list containing the state of the filtering system (enable,disable)

• The set of configured filter-list records

• Each of the configured filter records

• Filter number

• Interface number

• Filter direction (input,output)

• Filter state (enable, disable)

• Filter default action (tag, include, exclude)

Syntax: list

all

filter

Filtering: enabled
Filter List                   Action
-----------                   ------
test                          INCLUDE   

Filters
-------
Id   Default   State     Ifc  Dir       Cache
--   -------   -----     ---  ---       ------
1    INCLUDE   DISABLE   0    OUTPUT    16   

Example: list filter

Enter a filter number [1]? 
Id   Default   State     Ifc  Dir       Cache
--   -------   -----     ---  ---       ------
1    INCLUDE   DISABLE   0    OUTPUT    16   

Filter List                   Action
-----------                   ------
test                          INCLUDE  

Syntax: move filter-list-name1 filter-list-name2 filter-number

Reinit [C] [M]

Syntax: reinit

Set-Cache [C]

Syntax: set-cache filter-number cache-size

Enter a filter number [1]? 
Enter the new cache size [16]? 

The order in which the filter-items are specified for a filter-list is important as it determines the order in which the filter-items are applied to a packet.

Syntax: update filter-list-name

MAC Filtering Update Commands

[C] means you enter the command at the configuration prompt, which is filter filter-list-name config>.

Table 2 MAC Filtering Update Commands

Command	Function
Add [C]	Adds a hexadecimal number to compare against the source or destination MAC address. Adds filter items to a filter list. Adds a filter list to a filter.
Delete [C]	Removes filter-items from a filter-list.
Exit [C]	Exits the update subcommand configuration process.
List [C]	Lists a summary of all the filter lists and filters configured by the user. Also generates a list of attached filter lists for this filter and all subsequent information for the filter.
Move [C]	Reorders the filter lists attached to a specified filter.
Set-Action [C]	Sets a filter item to evaluate either include, exclude or tag (with a tag-number option).

Add [C]

The order in which you add filter-items to a filter-list is important as it determines the order in which the filter-items are applied to a packet.

Each use of the add subcommand creates a filter-item within the filter-list. The first filter-item is assigned filter-item-number 1, the next one is assigned number 2, and so forth. After an add, the router displays the number of the filter-item just added.

The first match that occurs stops the application of filter-items, and the filter-list evaluates to either include, exclude or tag, depending on the designated action of the filter-list. If none of the filter-items of a filter-list produce a match, then the default action (include, exclude or tag) of the filter is returned.

Syntax: add

source

destination

The hex-mask parameter must be the same length as hex-MAC-address and is logically ANDed with the designated MAC address in the packet. The default hex-mask argument is all binary 1's.

You can enter the hex-MAC-addr in canonical or non-canonical bit order. Canonical bit order is just a hex number (for example, 000003001234) or a series of hex digits with a dash between every two digits (for example, 00-00-03-00-12-34).

Non-canonical bit order is a series of hex digits with a colon between every two digits (for example, 00:00:C9:09:66:49). MAC addresses of filter-items are always displayed using either dash or colon to distinguish canonical from non-canonical representations.

Example: add source

Enter MAC Address []? 00-00-03-00-12-34
Enter MAC Mask [ffffffffffff]? 

Example: add destination

Enter MAC Address []? 00-00-03-00-12-34
Enter MAC Mask [ffffffffffff]? 

When you delete a filter item, any gap created in the number sequence is filled in. For example, if filter-items 1, 2, 3, and 4 exist and you delete filter-item 3, then filter-item 4 is renumbered to 3.

Syntax: delete filter-item-number

Exit [C]

Syntax: exit

List [C]

• MAC address and address mask in canonical or non-canonical form

• filter-item numbers

• address type (source or destination)

• filter-list action

canonical

noncanonical

Example: list canonical

non-canonical

Example: list non-canonical

Move [C]

Syntax: move filter-item-name1 filter-item-name2

Set-Action [C]

Syntax: set-action INCLUDE or EXCLUDE or TAG tag-number