3

I've seen this done before, but not sure how.

Looking for a way to have a centralized database of authorized MAC addresses and each switch to take the port-security status from this central database. basically we want to put all allowed MAC addresses in a DB and then have each switch lookup the connected hardware before placing in the CAM table.

What does Cisco even call that technology?

| improve this question | |
3

I'm pretty sure you're thinking of 802.1x. You can use that to permit hosts based on MAC addresses.

This isn't the most secure way to authenticate hosts since spoofing a MAC address is fairly trivial and can be achieved with a single command, in most cases.

| improve this answer | |
  • Man, I was really hoping to avoid 802.1X... – Scott Boultinghouse Feb 3 '14 at 22:11
  • @ScottBoultinghouse I don't think there is a much better solution out there. From a security perspective, Port-Security just doesn't cut it anymore, despite it's continued widespread use. – Ryan Foley Feb 3 '14 at 22:48
  • dot1x is not what you want. However, it can be configured to fallback to MAC authentication which will get you where you want to be at the expense of a dot1x timeout. – Ricky Beam Feb 4 '14 at 5:39
  • @RickyBeam How is 802.1x not sufficient for solving the OP? It does exactly what he needs done. – Ryan Foley Feb 4 '14 at 8:07
  • dot1x isn't what's doing it -- the failure of dot1x and it's subsequent fallback to "proxy" MAC authentication that works. If the client is aware of dot1x and begins EAPOL, then it will most likely fail. What he really wants is to have port-security authenticate on link -- much like a wireless system would. – Ricky Beam Feb 4 '14 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.