2

Consider a computer with Mac address (physical address) A, joins a network, and then it changes its Mac address to B. So, the network is able to recognise such a computer?

  • 1
    Welcome to Network Engineering! Care to be a little more specific on what you want to achieve? Do you want some kind of notification on mac change? Do you want the network to "automatically" react to the change? Is it as a security feature? – Mr Shunz Sep 6 '18 at 12:34
  • 1
    Assuming you have a Cisco environment, then you can use port-security to prevent hosts from changing MAC address on a port. – user36472 Sep 6 '18 at 12:34
  • 1
    @sas Since there are many different ways to configure and many different options to consider, i suggest reading this perfect guide from the Cisco forums: community.cisco.com/t5/network-architecture-documents/… – user36472 Sep 6 '18 at 12:53
  • 1
    Complete Cisco guide is here: cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-7-0E/… – user36472 Sep 6 '18 at 12:57
  • 1
    @sas Sorry, yes such a configuration should be possible. – user36472 Sep 6 '18 at 13:11
3

It sounds like what you are asking for, is in Cisco terms called Port Security. Port Security allows you to configure the network to restrict access to the port based on the MAC address. There are a few different variations of the feature

  1. Prevent more than X number of MAC addresses from being learned/used on the port
  2. Prevent any MAC address other than the one(s) statically configured from being learned/used on the port
  3. Allow X number of MAC addresses to be learned/used and then lock the port down to only those that are used. This is referred to as the "Sticky" feature

The difference between the 1st and 3rd options listed above are that in the 1st option, only X number of MACs can be used on the port at one time, but it could vary WHICH devices are in use. So if you say one MAC at a time, then you could connect one PC, and then later connect a different PC and it would be fine.

With the 3rd option, if you say one MAC and the sticky option, you are saying you want the network to learn the MAC that connects to the port and ONLY that device can use that port.

int gi1/0/1
 switchport port-security max 2
 switchport port-security mac-address sticky
 switchport port-security
 switchport mode access
 switchport access vlan 30

The above would be a basic example of the feature. This would say the port can learn 2 MAC addresses dynamically and then using the sticky feature, would lock the port to only allow those specific MAC addresses to be used. If the devices changed in the future, the port would have to be adjusted. Note that you need to use the switchport port-security command by itself on the port to turn the feature ON. Otherwise, you would just be listing options that are not used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.