Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

I have a situation where I'm required to install a switch in a location that is physically insecure and has guests coming and going. It is in the audio rack of a sound desk at a facility that has lots of non-staff members that have physical access to it.

It is a HP ProCurve switch. I plan on taking the following precautions, but am looking for any loopholes I may have missed:

  1. Disable the physical device reset buttons on the front of the switch (in software), not with epoxy
  2. Disable all ports that are not in active use
  3. Port-based VLAN for the active ports that take them off the main network and onto a less trusted network (but cannot go to a dmz-style totally untrusted network)
  4. Leave two ports enabled that go immediately to a captive portal on a guest VLAN for, well, guests. (the use of these ports will be publicly documented)
  5. Port-based 802.1X authentication based on known MAC addresses for the active, non-guest ports
  6. The uplink port will use 802.1q trunking with a native VLAN that is unused.

The cabling will be static. It will virtually never change, apart from the two guest ports.

I know for a fact that due to the sort of people that come through the location that they will be curious to see what's on the switch, and I don't want them getting into the protected part of the network unless they actively attempt to subvert the security. (And if they do that, then that's a question for security.se)

share|improve this question
1  
I would look at either static cables for the guest ports or use a patch panel for them to avoid wear and tear on the physical switch ports. –  legioxi Aug 15 at 10:51
    
I suppose a Claymore mine is out of the question. –  generalnetworkerror Aug 16 at 7:35

2 Answers 2

You also need to consider console port security - ie making sure AAA is enabled on the console. If the ProCurve doesn't support AAA on the console port, then make sure the login password for the console line is strong (and maybe rotated every 90 days or so).

share|improve this answer
    
Good point. We authenticate against a RADIUS server anyway but it's good to have it physically noted for future reference. –  Mark Henderson Aug 15 at 5:06

I'd use a patch panel protector if port security was a real issue.

Of course, this depends on the access needed, frequency of physical port changes, and the composition of the rest of the rack/enclosure.

enter image description here

share|improve this answer
    
This approach does not adequately give any protection at all. It might deter some unknowledgeable malicious people but it really gives a false sense of security. It would be quite easy to open this type of enclosure by means of lock picking or even a drill/hammer/wedge. –  ponsfonze Aug 15 at 11:54
    
@ponsfonze in the question I state that my current scope is to keep out curious parties. I think this would do quite well to keep them out. I'm not concerned with people who want to actively subvert the network in the scope of this question. –  Mark Henderson Aug 17 at 2:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.