I've seen this done before, but not sure how.

Looking for a way to have a centralized database of authorized MAC addresses and each switch to take the port-security status from this central database. basically we want to put all allowed MAC addresses in a DB and then have each switch lookup the connected hardware before placing in the CAM table.

What does Cisco even call that technology?

1 Answer 1


I'm pretty sure you're thinking of 802.1x. You can use that to permit hosts based on MAC addresses.

This isn't the most secure way to authenticate hosts since spoofing a MAC address is fairly trivial and can be achieved with a single command, in most cases.

  • Man, I was really hoping to avoid 802.1X... Commented Feb 3, 2014 at 22:11
  • @ScottBoultinghouse I don't think there is a much better solution out there. From a security perspective, Port-Security just doesn't cut it anymore, despite it's continued widespread use.
    – Ryan Foley
    Commented Feb 3, 2014 at 22:48
  • dot1x is not what you want. However, it can be configured to fallback to MAC authentication which will get you where you want to be at the expense of a dot1x timeout.
    – Ricky
    Commented Feb 4, 2014 at 5:39
  • @RickyBeam How is 802.1x not sufficient for solving the OP? It does exactly what he needs done.
    – Ryan Foley
    Commented Feb 4, 2014 at 8:07
  • dot1x isn't what's doing it -- the failure of dot1x and it's subsequent fallback to "proxy" MAC authentication that works. If the client is aware of dot1x and begins EAPOL, then it will most likely fail. What he really wants is to have port-security authenticate on link -- much like a wireless system would.
    – Ricky
    Commented Feb 4, 2014 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.