cancel
Showing results for 
Search instead for 
Did you mean: 

Create ACL for specific ELRP vlan

Create ACL for specific ELRP vlan

Frank_Veen
New Contributor II
Hello,

We have configured a ELRP dedicated vlan and configure this vlan tagged on all ports.
We would like to secure this vlan to allow only EDP /ELRP packets.
Can anyone help with setting up an ACL which allows only EDP/ELRP packets?

We think the source MAC address which should be allowed is 00:E0:2B:00:00:01 (EDP)

Would this be correct:

vi ELRP-FILTER.pol

entry EDP-ELRP {if {
ethernet-source-address 00:e0:2b:00:00:01;
} then {
copy-cpu-and-drop;
}
}


entry DROPALL {
if {
} then {
deny;
}
}

configure access-list ELRP-FILTER vlan elrp_vlan ingress

Kind regards,

Frank van der Veen
5 REPLIES 5

Henrique
Extreme Employee
Hi Frank, this rule should affect only EDP and not ELRP.

ELRP packets use the switch MAC for source and destination (for destination it's the switch MAC with the first bit = 1)

Do you want to block ARP packets as well?

Could you please confirm what are you trying to accomplish? Just allow ELRP and block everything else, including EDP and ARP?

Thanks

Flavio
New Contributor III


Hi Henrique.
I want to block ELRP packets on the ports towards my firewall. Would this ACL be doing this, or is something to be corrected here?

entry detect-elrp {
if {
# 00:04:96 = ELRP prefix
ethernet-destination-address 01:04:96:01:01:01 mask ff:ff:ff:00:00:00;
} then {
deny;
}
}

Thanks,
Flavio.

Frank_Veen
New Contributor II
Hello Henrique, Paul,

Thank you for helping.

We have created the following acl which seems to do the job in our lab so far:

entry EDP-ELRP {if {
ethernet-source-address 00:e0:2b:00:00:01;
} then {
copy-cpu-and-drop;
}
}


entry DROPALL {
if {
} then {
deny;
}
}

configure access-list ELRP-FILTER vlan elrp_vlan ingress


Frank

Paul_Russo
Extreme Employee
Hello Frank

You could try creating a protocol based VLAN where it will only send packets that are the particular EtherType or SNAP.

I think EDP/ELRP is 0xaa but do a sniffer trace to make sure. Once you have that you can create protocol and then use that value.

See if that works

P

GTM-P2G8KFN