I have a situation where I'm required to install a switch in a location that is physically insecure and has guests coming and going. It is in the audio rack of a sound desk at a facility that has lots of non-staff members that have physical access to it.

It is a HP ProCurve switch. I plan on taking the following precautions, but am looking for any loopholes I may have missed:

  1. Disable the physical device reset buttons on the front of the switch (in software), not with epoxy
  2. Disable all ports that are not in active use
  3. Port-based VLAN for the active ports that take them off the main network and onto a less trusted network (but cannot go to a dmz-style totally untrusted network)
  4. Leave two ports enabled that go immediately to a captive portal on a guest VLAN for, well, guests. (the use of these ports will be publicly documented)
  5. Port-based 802.1X authentication based on known MAC addresses for the active, non-guest ports
  6. The uplink port will use 802.1q trunking with a native VLAN that is unused.

The cabling will be static. It will virtually never change, apart from the two guest ports.

I know for a fact that due to the sort of people that come through the location that they will be curious to see what's on the switch, and I don't want them getting into the protected part of the network unless they actively attempt to subvert the security. (And if they do that, then that's a question for security.se)

  • 1
    I would look at either static cables for the guest ports or use a patch panel for them to avoid wear and tear on the physical switch ports. – some_guy_long_gone Aug 15 '14 at 10:51
  • 1
    I suppose a Claymore mine is out of the question. – generalnetworkerror Aug 16 '14 at 7:35
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 5:02

I'd use a patch panel protector if port security was a real issue.

Of course, this depends on the access needed, frequency of physical port changes, and the composition of the rest of the rack/enclosure.

enter image description here

| improve this answer | |
  • This approach does not adequately give any protection at all. It might deter some unknowledgeable malicious people but it really gives a false sense of security. It would be quite easy to open this type of enclosure by means of lock picking or even a drill/hammer/wedge. – ponsfonze Aug 15 '14 at 11:54
  • @ponsfonze in the question I state that my current scope is to keep out curious parties. I think this would do quite well to keep them out. I'm not concerned with people who want to actively subvert the network in the scope of this question. – Mark Henderson Aug 17 '14 at 2:01

You also need to consider console port security - ie making sure AAA is enabled on the console. If the ProCurve doesn't support AAA on the console port, then make sure the login password for the console line is strong (and maybe rotated every 90 days or so).

| improve this answer | |
  • Good point. We authenticate against a RADIUS server anyway but it's good to have it physically noted for future reference. – Mark Henderson Aug 15 '14 at 5:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.