2960 Allow only PPPoE on port

Question

Hi all,
is there any way to allowe only PPPoE comunication on ethernet port on 2960X or 2960S catalyst switches?
Thanx
BR
David

Answer 1

Hi Reza,
I think David's question focused on something else: can you configure an access port on a switch so that the only frame it accepts is a PPPoE frame?
In my opinion, that should be possible - the easiest way of doing that would simply be to configure a port-ACL (PACL) that drops all IP traffic whatsoever. PPPoE-encapsulated packets are not treated as IP packets by the switch, so IP PACL will not apply. So simply doing something like this should do the trick:
ip access-list standard NoIP deny any!interface FastEthernet0/1 ip access-group NoIP in
If we wanted to be very precise, we could also create a MAC ACL to further narrow down the non-IP traffic allowed through a port. PPPoE uses EtherType values 0x8863 and 0x8864. The MAC ACL would need to be carefully specified, though, to allow other Layer2 control and management plane traffic (STP, DTP, VTP, CDP, LLDP, PAgP/LACP, UDLD, LOOP...), so it could be more difficult to create properly.
I even believe that creating a VACL would be possible although the VACLs are not officially supported on 2960 Catalysts yet (still, with a very recent IOS, they can be created and used just fine).
Best regards,
Peter