My company wanted to prevent rogue PCs from being connected to our network as our server room was shared between us and our clients in one of our sites. Network access was allowed only for our company users and specifically for PCs that are provided by the company.

802.1x was not an option because we were not able to implement Radius server in that site. Port security was also not an option as the our users had to move between different offices from time to time.

I have suggested MAC ACL to be implemented on our access switches as we are aware of our PCs MAC addresses that are allowed on our network.

the thing is I have tested this MAC address ACL on the switch that I am connected to to allow only my PC and IP phone on that port.

when I connected a different laptop (considered as rogue PC) to the same port it was able to get an IP from the our DHCP server which we also want to prevent to happen.

my configuration was :

STA6-2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
STA6-2(config)#mac access-list extended TEST
STA6-2(config-ext-macl)#permit host a048.1c8f.22df any
STA6-2(config-ext-macl)#permit host 2C3E.CF7B.A2B9 any

STA6-2(config)#interface fa
STA6-2(config)#interface fastEthernet 0/19
STA6-2(config-if)#mac acc
STA6-2(config-if)#mac access-group TEST in

STA6-2#show access-lists
Extended MAC access list TEST
    permit host a048.1c8f.22df any (2 matches)
    permit host 2c3e.cf7b.a2b9 any

Kindly give me your feed back on the same and how to implement a proper MAC ACL to allow only a specific MAC addresses from having any communication with any resource on our network.

  • The idea is sound, and likely to be helpful against "accidental" and "just having a look" connections; it is weak against a determined attack. Locked racks will help. In the end, network security is conditional on physical security. Re implementation, could you show connectivity of PCs, switches, routers.
    – jonathanjo
    Commented Oct 31, 2017 at 9:06
  • You can look at this question and answers. It really is very simple to clone a MAC address.
    – Ron Maupin
    Commented Oct 31, 2017 at 13:33
  • The other question is the hardware in use. Where- and how- support for MAC ACL's is implemented varies wildly not only by vendor but platform within vendors. There are also potentially multiple ways in which this can be handled (ex: in the Cisco world PACL vs VACL).
    – rnxrx
    Commented Oct 31, 2017 at 18:25


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.