topic Re: MAC Filtering in RUCKUS Support for Lennar Homes

Re: MAC Filtering

WF_DUB — Wed, 16 Nov 2022 05:25:56 GMT

Hi Ben,

I'm running 08.0.95gt211 I just updated to this image file last week and that's when I noticed the issue. Is there a later one I should be on?

I went through 2 firmware updates to get to this one, don't really want to do more if I don't have to. I am not a network engineer so it was a bit stressful a couple of times. Would be a lot easier if the app, web interface, or GUI would just let me do an update and it loads everything automatically.

"Show Run" says I have a mac filter for port 11

Looks like the mac filter is on for port 11 to only permit the mac address I gave (which is good). However, what if I wanted to clear this?
I don't mind opening a support case, but last time I did I was told they don't support Lennar home owners anymore. Would you like me to submit one anyway?

Re: MAC Filtering

Vásquez_Fer — Wed, 16 Nov 2022 15:40:10 GMT

Hi @WF_DUB

Hope you are doing well !

If you want to revert the changes you applied basically you have to go to interface 1/1/11 and write No at the initial part of the command to remove the configuration from the ACL MAC applied.

ICX7250-24P Device>ena
ICX7250-24P Device#conf t
ICX7250-24P Device(config)#interface ethernet 1/1/11
ICX7250-24P Device(config-if-e1000-1/1/11)#no mac-access-group mf_1 in

There is also another way to perform Mac address filter on a specific port

Example:

ICX7250-24P Device(config)#mac filter 1 permit 0050.56AB.ABD8 fffF.FFF.FFF ANY
ICX7250-24P Device(config)#mac filter 2 deny any any

ICX7250-24P Device(config)#interface ethernet 1/1/11
ICX7250-24P Device(config-if-e1000-1/1/11)#mac filter-group 1 to 2

Basically this will allow the assigned mac to be the only one that can go out and receive data and deny another mac address on the assigned port this configuration

https://docs.ruckuswireless.com/fastiron/08.0.60/fastiron-08060-securityguide/GUID-22E17C0E-6595-4297-A5EB-0F723CFAF22F.html

Best Regards

Fernando Vasquez

Re: MAC Filtering

WF_DUB — Thu, 17 Nov 2022 06:24:50 GMT

This helps slightly, it does tell me how to remove the mac filter which is good to know. It also provides another avenue for applying one (quite an easier way too).

Can you explain why you recommend applying two mac filters to the port instead of just one? Meaning, in your example mac filter 1 permits a specific device. Then mac filter 2 denies any device., then you applied both of these mac filters to port 1/1/11.

Doesn't writing the below accomplish the same thing? Meaning, why do you need to "deny any any" if I am already writing to "permit" a specific address. I thought what I wrote below basically says to ONLY permit the mac address listed and therefor all other addresses are automatically denied.

ICX7250-24P Device(config)#mac filter 1 permit 0000.0006.3a4f ffff.ffff.ffff any
ICX7250-24P Device(config)#interface ethernet 1/1/11
ICX7250-24P Device(config-if-e1000-1/1/11)#mac access-group mf_1 in

Still, the GUI should allow this as it used to. It was fine when I was on image file 08.08, but once I went to 08.0.95 it went away. What image should I be on for my switch? I would like the GUI to show my mac lists correctly.

Re: MAC Filtering

Vásquez_Fer — Thu, 17 Nov 2022 15:27:44 GMT

Hi @WF_DUB

Hope you are doing well !

After checking the release notes on version 8095x + found that the Mac filter was modified to be Mac address access list for that reason does not allow to see the MAC filters on the GUI or create new Mac filters since this feature is no longer available.

This ACLs MACs would be only be visible through the CLI.

As you can see in the below picture you are going to see the MAC filter command was removed

This is the new way to preform ACLs MAC filters on 8095x + versions

https://docs.commscope.com/bundle/fastiron-08095-securityguide/page/GUID-28D251BE-8752-4F4C-96AA-14D3ECBBD6B1.html

If this feature is so important to you via GUI I would recommend the SPS8090mc version for you.

MAC filter is a configuration in sequence therefore, if you do not apply the deny any any option, it will allow any device to use this port (assuming that what you want is to configure that only 1 device is allowed per port)

https://docs.ruckuswireless.com/fastiron/08.0.60/fastiron-08060-securityguide/GUID-22E17C0E-6595-4297-A5EB-0F723CFAF22F.html

This is a example I crate a MAC filter with a specific MAC address ( I did not add the deny any any ) and connect a PC ( with a different MAC ) to my switch and allow me ping ( sent data ) to the IP address as you can see '1'

once I applied the deny any any on the Switch '2' I say that it is not allowed that another device that is not in the filter (configured) can connect or have connectivity to my switch.

PC MAc 0050.56abab.d8

Config:

mac filter 1 permit 0051.56ab.abd8 ffff.ffff.ffff any
mac filter 2 deny any any

Best regards

Fernando Vasquez