4

My company wanted to prevent rogue PCs from being connected to our network. Network access must be allowed only for our company users and specifically for PCs, Printers.. that are provided by the company.

Port security is not an option as our users need to move between different offices from time to time.

I have suggested MAC ACL to be implemented on our access switches as we are aware of our PCs MAC addresses that are allowed on our network.

Now i need help on how to implement (syntax) such MAC ACL ?

  • 3
    While this is possible, it is rather pointless. It is very easy for someone to clone a MAC address from one device to another. The real way to do this is with 802.1X. – Ron Maupin Mar 2 '18 at 15:20
  • If you're asking for syntax, it would help if you provide the make/model of the switches you are using. =) – Eddie Mar 2 '18 at 18:11
  • @RonMaupin i know about Mac spoofing and i agree with you MAC ACL is pointless to a certain level but it's a temporary solution for now. – samikzr Mar 2 '18 at 20:14
  • @Eddie i'm using Cisco catalyst 2950, 2960 and 2970. – samikzr Mar 2 '18 at 20:15
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 22:26
1

It's indeed possible to configure this - nevertheless there's a "trick" called "MAC spoofing" in which someone fakes a MAC-Address - and this can easily be done.

There's a standard called 802.1X (RADIUS) which will fit your needs.

Nevertheless, for that you need a supplicant software (A supplicant (PC, Tablet, ..) has the data stored in order to be able to authenticate itself on the RADIUS-server (authentication-server)) which is not configured natively on every device such as printers. (Maybe your printers have a supplicant software or are able to install it)

For those you would have to use MAC-Bypass (Which will authenticate a device by its MAC). Unfortunately this would create the same problem as stated above - but for fewer devices.

  • can you please help me with documentation or some kind of guidance to achieve this. thanks in advance for replying – samikzr Mar 2 '18 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.