How to configure MAC ACL on Smart and L2 Managed switches using the new GUI

Configuration Guide
수정일06-06-2018 03:44:41 AM 17209
본 내용은 다음 항목에 적용됩니다: 

This article applies to:

T1500G-10PS v2 or above, T1500G-8T v2 or above, T1500G-10MPS v2 or above, T1500-28PCT v3 or above, T1600G-52TS v3 or above, T1600G-52PS v3 or above, T1600G-28PS v3 or above, T1600G-28TS v3 or above, T1600G-18TS v2 or above, T1700X-16TS, T2600G-52TS v3 or above, T2600G-28TS v3 or above, T2600G-28MPS v3 or above, T2600G-28SQ v1 or above.


MAC ACL can be used to control packet transmission based on MAC addresses. In a simple scenario, the administrator can use MAC ACL to restrict the communication between different devices.



As the following topology shows, the Marketing department is connected under port 1 of the switch. It is required that the Marketing department cannot visit the FTP server, except the administrator.

Configuration Scheme:

In this scenario, MAC ACL is recommended to fulfill the requirement. We can only create several MAC ACL rules to permit the access of the administrator and deny the access of the other marketing department members.

1. Go to SECURITY > ACL > ACL Config page, create a MAC ACL 100 for the marketing department.

2.After the above step, the MAC ACL 100 will appear in the ACL Config table. Click to add ACL rules.

3.Click  to add MAC ACL rules.

4.Configure rule 5 to permit packets from the administrator host to the FTP server with the source MAC address 8C-DC-D4-40-A1-79 and destination MAC address 40-61-86-FC-71-56.

5.Configure rule 15 to deny other packets to the FTP server with destination MAC address 40-61-86-FC-71-56.

6.Configure rule 25 to permit all the other packets that match neither of the above rules.

7.Go to SECURITY > ACL > ACL Binding > Port Binding page, click to load the following page. Bind MAC ACL 100 to port 1 to make the ACL rules take effect.


Every ACL has an implicit “deny all” rule at the end of an ACL rule list. That is, if an ACL is applied to a packet and none of the explicit rules match, then the final implicit deny all rule takes effect and the packet is dropped.

구독TP-Link는 귀하의 개인 정보 보호를 중요하게 생각합니다. TP-Link의 개인 정보 보호에 대한 자세한 내용은, TP-Link의 개인 정보 보호 정책을 참조하십시오.

From United States?

해당 지역의 제품, 이벤트 및 서비스를 받아보세요.