Remember that Ethernet and Tokenring MACs are bit swapped! The cannonical rule! This impacts the access-lists. An access-list designed for ethernet wouldn't work for token ring. | ACCESS-LISTS - NON ROUTABLE PROTOCOLS Key Commands Shows and Debugs Extended MAC access lists Access-list 1101 deny access-list 1101 permit interface ethernet 0 bridge-group 1 input-pattern-list 1101 bridge-group 1 output-pattern-list 1101 or on Token ring interface tokenring 0 source-bridge output-pattern-list 1101 source-bridge input-pattern-list 1101 Show access-expression Debug access-expression Show access-list Additional Commands For standard MAC access lists Access-list 701 701 deny permit Acce ss-list inte rface ethernet 0 br idge-group 1 output-address-list 701 br idge-group 1 input-address-list 701 inte rface t okenr ing 0 so urce-br idge input-address-list 701 so urce-br idge output-address-list 701 FOR DLSW The a ccess-list is placed on the remote-peer statement LSAP address access-lists Grouped by pair of source and destination LSAP 0xF0F0 is F0 source to S0 destination. Access-list 201 deny 0xF0F0 0x0 - denies source F0 to destination F0 access-list 201 deny 0xF000 0xFF - denies source F0 destination any access-list 201 deny 0xF0 0x00F0 0xFF00 - denies any LSAP with destination F0 any LSAP any LSAP For ethernet Bridge-group 1 input-lsap-list 201 Bridge-group 1 output-lsap-list 201 dlsw remote-peer 0 tcp dmac-output-list 701 201 201 For DLSW Dlsw remote-peer 0 tcp lsap-output-list 201 Spot The Issue Remember that Ethernet and Tokenring MACs are bit swapped The cannonical rule This impacts the access-lists. An access-list designed for ethernet wouldn t work for token ring. When configuring a netbio access list IOS prompts for WORD NetBIOS station name . This is NOT the NetBIOS name to be filtered. It is the name of the NetBIOS access list When configuring an access expression DO NOT put a smace between smac and - smac 200 good smac 200 bad Notes 200 - LSAP .
