4

We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.

From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.

Meraki switch port settings

Is this correct or have I missed something?

  • 4
    Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do. – Jesse P. Mar 21 at 14:20
7

As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.

You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.


If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.

  • 5
    Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't. – Ricky Beam Mar 21 at 15:01
  • 6
    Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs. – Ron Maupin Mar 21 at 15:05
  • @RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches. – techkilljoy Mar 22 at 14:24
  • 1
    You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to use bpduguard in case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces. – Ron Maupin Mar 22 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.