Assuming you are coming into the router from a Cisco switch, you could enable mac security using static mac entries on the switchport, only allowing traffic to pass between the router and the two macs you wish to allow into the router. Then just est up IP routes to forward L3 adreses as desired, knowing the L2 hosts were "secured". This will not, of course, stop MAC spoofing if security is a concern.
The attached pdf is an IOS reference for a 4500 switch, but its effectively the same for the entire range of current cisco gear from 2900 series through 6500 series.
Main Topics
Browse All Topics
by: atlas_shudderedPosted on 2008-05-20 at 12:10:44ID: 21609272
Routers will not handle traffic based on mac addy. The only mac addresses available to your router are the one for the next hop interface and the address of the sending interface. These are used for next hop connectivity at the interface level only and are otherwise "unrecognized" by your router.
One potential way around your problem would be to use VLANs and static DHCP assignments. You could segment your address space further, vlan these segments and route between using virtual interfaces. Group your devices by access role into the subnet pools and then use ACL's to further control traffic/access. At this level you could control traffic based on subnet, range or individually, also dependent on traffic type.
If you really wanted to control the environment and you don't mind it being highly manual, you could assign DHCP addressing via static maps to mac addy. I guess this would go back to what the importance of specifically identifying the device is and if you have the latitude to regroup.