How do I configure MAC address filtering on Cisco 1721 router?

Posted on 2009-05-21
Medium Priority
Last Modified: 2012-05-07
Our company has a Cisco 1721 router in which I have setup remote users IP Addresses in the router SDM firewall configuration to pass thru to our separate VPN server machine.  The problem is my remote users' ISP's change their IP Addresses randomly which causes me to go back to the router and input the new IP so they can get connected.  Is there a way to use the MAC ID of my users' machines instead of the IP Address?  I read somewhere that it can be done using ACL, but not sure on how to go about doing that?  Any help is greatly appreciated.
Question by:dynamictechinc
  • 2
LVL 50

Expert Comment

by:Don Johnston
ID: 24443204
That's not going to help. Layer 2 headers (where MAC addresses are located) are stripped off and recreated every time the packet passes through a router.

Expert Comment

ID: 24443263
You could also use a dynamic ACL. It requires the user to be input into the router and they would have to telnet to the router each time, but it will automatically update the ACL with the Client PC's IP address permitting access. This may also be a better option as it is very likely that the packet you get to your router, has one of the client's ISP's router's MAC addresses. I am not currently aware of any methodology where you can filter traffic by MAC address.
The other benefit of using a Dynamic ACL is that they are not restricted to their current PC, and it also deletes the access after a finite period of time, closing the potential security hole.

Accepted Solution

dnairns earned 2000 total points
ID: 24451855
The fact that the MAC address is stripped every time it goes through a router, which it does at each ISP that it passes through. The best option is to use a Lock-and-Key Access List (Dynamic ACL). Cisco has a very good document on how to do this, and if you are good at scripting, you can write a script file to have their computer telnet in, pass the credentials, and then start an RDP session to the host, automating the entire process.
But to get you started on the router config side of things you will want to use this guide from cisco. It is a walkthrough to get the router configured. Note you need to be using IOS version 11.1 or later.
Hope this is helpful. i know it is a little bit more complex, and time consuming, but if you get more hosts and they are changing frequently this will lower your TCO over time.

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
If you use NetMotion Mobility on your PC and plan to upgrade to Windows 10, it may not work unless you take these steps.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

588 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question