[GS-5220,IGS-5225,IGS-6325 series] How to configure ACL feature by MAC address.

In order to block all traffic from a certain MAC address, the Ethernet type and ARP of ACE rules must be set at the same time.

Here is an ACL example for MAC address:

Goal: Blocking the traffic with Source MAC address 00-05-1b-33-44-ed.

Step 1: Go to the ACE Configuration following the path: Security → Access Control List → ACL Configuration.

Step 2: Add an Ethernet type of ACE rule:

         1. Set the Ingress Port as All, set the Frame Type as Ethernet Type.

         2. Set the SMAC Filter as Specific, input the SMAC Value, and set the DMAC Filter as Any.

         3. Set the EtherType Filter as Any.

         4. Set the Action as Deny. 

Step 3: Add an ARP of ACE rule:

         1. Set the Ingress Port as All, set the Frame Type as ARP.

         2. Set the SMAC Filter as Specific, input the SMAC Value, set the DMAC Filter as Any.

         3. Set the ARP Parameters as Any.

         4. Set the Action as Deny. 

Step 4: Additionally, we recommend to set the ARP Inspection as disabled and clear the ARP table on the switch and PC.

Thus, the switch can support the goal: Blocking the traffic with Source MAC address 00-05-1b-33-44-ed.