Layer 2 Security · Topic 5 of 7

Switch ACL and Switch Security

Write switch chip rules that drop, redirect or copy traffic at wire speed, and apply a practical hardening checklist for ports, management and services.

5 min

In a nutshell

Switch rules run in the chip, in hardware, in order.
An empty new-dst-ports drops the matching frame.
Other actions redirect, copy to the CPU, or mirror.

What it is

A switch access control list is a set of rules in the switch chip that filters frames at wire speed.

It does the same job as the bridge filter, but it runs in hardware. It cannot do as much, because the chip supports a fixed set of matchers and actions. In return, it filters without loading the CPU.

Switch security is the wider habit of closing doors you do not use. The rule table is one tool, and port, management and service settings are the others.

How it works

Rules match on ingress ports and frame fields, and each rule applies its action to the frames it matches.

The rule table

Switch rules live under the switch menu.

/interface ethernet switch rule add ports=ether2 src-mac-address=00:11:22:33:44:55/FF:FF:FF:FF:FF:FF new-dst-ports=""
/interface ethernet switch rule print

The rule applies to frames that enter the listed ports and match the other conditions. An empty new-dst-ports means the frame has no destination, so it is dropped.

Matchers and actions

Typical matchers are:

Source and destination MAC addresses, with masks.
mac-protocol, such as ip or arp.
Source and destination IP addresses, and the IP protocol.
Port numbers for TCP and UDP.
vlan-id.

The actions let the chip drop, redirect, copy or mirror a frame, or change its VLAN or priority.

Action	Effect
Empty `new-dst-ports`	Drop
`new-dst-ports=ether5`	Send only to that port
`redirect-to-cpu`	Hand the frame to the CPU only
`copy-to-cpu`	Send to the CPU and forward normally
`mirror`	Copy to a mirror target

Examples

Block Telnet entering a user port.

/interface ethernet switch rule add ports=ether2 mac-protocol=ip protocol=tcp dst-port=23 new-dst-ports=""

Block a user port from reaching a management subnet.

/interface ethernet switch rule add ports=ether2 mac-protocol=ip dst-address=192.168.99.0/24 new-dst-ports=""

Rule order and limits

Rules are checked in order, so put specific rules above general ones.

The rule table is held in a small, fast memory, so the number of rules is limited. Match fields also differ between chip families, and not every combination is allowed. Plan the rules with groups of ports and address ranges, not with one rule per host.

Watch out

A switch rule acts before the bridge sees the frame. A mistaken drop rule on the uplink port can cut off your own management access.

Comparing the two filters

Aspect	Switch rule	Bridge filter
Runs in	Switch chip	CPU
Speed	Wire speed	Limited by the CPU
Matchers	Fixed set	Many
Offload	Keeps it	Can stop it

Switch security checklist

Use a short list of habits on every switch.

Disable unused ports, so nobody can plug in unnoticed.
Use a management VLAN, and keep it away from user ports.
Limit management services, and turn off what you do not use.
Limit discovery and MAC access, to trusted interfaces only.
Protect spanning tree, with edge ports, restricted role and BPDU guard.
Control flooding and loops, with loop protect and storm limits.
Keep software current, and use strong passwords for every user.

/interface ethernet set ether8 disabled=yes
/ip service set telnet disabled=yes
/ip neighbor discovery-settings set discover-interface-list=LAN
/tool mac-server set allowed-interface-list=LAN

Each line closes one door. The first disables a port, the second turns off an insecure service, and the last two keep discovery and MAC access to the LAN interface list.

Restricting who can manage the switch

Limit management to a trusted address range.

/ip service set ssh address=192.168.99.0/24

A service with an address list answers only to those networks. Combine it with a firewall rule on the router, and with the management VLAN.

Exam tip

Do all hardening in a session that has a second way in, such as a console cable, in case a rule blocks you.

What to remember for the exam

Seven facts cover most questions on this topic.

Switch rules run in the chip, in hardware, in order.
An empty new-dst-ports drops the matching frame.
Other actions redirect, copy to the CPU, or mirror.
The rule table is small, and match fields depend on the chip.
Switch rules keep hardware offload, and bridge filters can stop it.
Disable unused ports and unused services.
Keep discovery and MAC access on trusted interfaces only.

Common mistakes

These four mistakes appear often.

Blocking the management path. A drop rule on the uplink port can lock you out.

One rule per host. The table is small, so use groups.

Leaving unused ports enabled. Anyone can plug in and join the network.

Leaving discovery open on all ports. Device names and versions leak to user ports.

Check yourself

Work through these three questions.

How does a switch rule drop a frame?
It uses an empty new-dst-ports, so the frame has no destination.
Why use a switch rule instead of a bridge filter?
The chip applies it at wire speed and keeps hardware offload.
Which two steps from the hardening checklist close the most obvious doors?
Disable unused ports, and limit management services to trusted networks.

Topic 5 of 7 in Layer 2 Security

Test yourself on Layer 2 Security

The full MikroTik MTCSWE question bank has 484 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.