In our organization, there are more than 2000 Internet users. Someone is connecting a Wi-Fi device in our LAN port and accessing the Internet without my knowledge.

Is possible to block the Wi-Fi router when it is connected to my LAN port? I want to configure this in my Cisco SG300 28-port switch.

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12 '17 at 22:26

You could enable port-security with a low max number of MAC, say 1 or 2, on each port in the switch. Set the violation mode to shutdown (or restrict, depending on your goal). If you don't want to do this globally, you should be able to easily ID the port in question if your only switch the the SG300 mentioned. Use

sh mac addr 

and look for the switch port with multiple MACs hanging off of it that is NOT your uplink.


Trace MAC of that wi-fi router and do this for each VLAN on you switch.

Switch(conf)#mac address-table static [mac_address]  vlan [id] drop

The real way to do something like this is to use 802.1X. That would let you authenticate all devices connecting to your switch interfaces, and it is pretty fine-grained. The problem with 802.1X is that it needs a server/software infrastructure.

While port security could be used to thwart some cases of using a WAP, or other bridge (switch), using port security can be fooled by a router because the router would only have a MAC address of the router coming through the switch interface. Port security can also have problems if you have VoIP phones because they can use two or three MAC addresses, or if different devices need to connect to the same switch interface in a relatively short period of time.


While other answers are definitely correct, one additional method to help prevent un-authorized devices is to use spanning-tree bpduguard enable on the switchports that should be going to single hosts.

This will put the port into an err-disabled state if it sees any spanning-tree bpdu packets ingress to the port. A lot of wifi-routers will trigger this condition. Generally, I configure the following on access ports facing users:

spanning-tree bpduguard enable
spanning-tree guard root
switchport port-security <max 2> (if using VoIP phones with the desktop patched to the phone) 
  • You can enable things like portfast and bpduguard globally. This will not enable it on trunk ports, only on access ports, and it is far easier than changing it on the ports as they change function. BPDUs would not be generated by the WAN interface of a consumer-grade router, only the switch module, should one of those interfaces be connected to your switch.
    – Ron Maupin
    Jan 15 '17 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.