OBJECTIVE
The purpose of this post is to present an introduction to Example for Assigning VLANs based on MAC Addresses.
Networking Requirements
On a company intranet, the network administrator adds the PCs in a department to the same VLAN. To improve information security, only employees in this department are allowed to access the intranet.
As shown in Figure 1, only PC1, PC2, and PC3 are allowed to access the intranet using SwitchA and SwitchB.You can assign VLANs based on MAC addresses and associate MAC addresses of PCs with the specified VLAN.
Figure 1 - Networking diagram for assigning VLANs based on MAC addresses
Configuration Roadmap
The configuration roadmap is as follows:
1. Create VLANs.
2. Add Ethernet interfaces to VLANs so that packets of the VLANs can pass through the interfaces.
3. Associate MAC addresses of PC1, PC2, and PC3 with the specified VLAN so that the VLAN of the packet can be determined based on the source MAC address.
Procedure
1. Configure the Switch.
# Create VLANs.
<Huawei> system-view
[Huawei] vlan batch 10 100
# Set the PVID of interfaces and add interfaces to the VLANs.
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] port hybrid pvid vlan 100
[HUAWEI-GigabitEthernet0/0/1] port hybrid untagged vlan 10
[HUAWEI-GigabitEthernet0/0/1] quit
[HUAWEI] interface gigabitethernet 0/0/2
[HUAWEI-GigabitEthernet0/0/2] port hybrid tagged vlan 10
[HUAWEI-GigabitEthernet0/0/2] quit
# Associate MAC addresses of PC1, PC2, and PC3 with VLAN 10.
[HUAWEI] vlan 10
[HUAWEI-Vlan10] mac-vlan mac-address 22-22-22
[HUAWEI-Vlan10] mac-vlan mac-address 33-33-33
[HUAWEI-Vlan10] mac-vlan mac-address 44-44-44
[HUAWEI-Vlan10] quit
# Enable MAC address-based VLAN assignment on GE0/0/1.
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] mac-vlan enable
[HUAWEI-GigabitEthernet0/0/1] quit
2. Verify the configuration.
PC1, PC2, and PC3 can access the intranet, whereas other PCs cannot access the intranet.
Configuration Files
Configuration file of the Switch
#
sysname HUAWEI
#
vlan batch 10 100
#
vlan 10
mac-vlan mac-address 0022-0022-0022 priority 0
mac-vlan mac-address 0033-0033-0033 priority 0
mac-vlan mac-address 0044-0044-0044 priority 0
#
interface GigabitEthernet0/0/1
port hybrid pvid vlan 100
port hybrid untagged vlan 10
mac-vlan enable
#
interface GigabitEthernet0/0/2
port hybrid tagged vlan 10
#
return
--- End
