The culture at one of our main branch offices is very open and loose. Historically when people have needed more ports in their space they could just grab a switch from someone with access to our equipment room and this was OK with management.

This is not OK to me. I have about 30 small desktop class switches of various flavors which connect up through patch panels to primary access level gear like Cisco 3750's. I want to centralize distribution of small switches and prevent undocumented sprawl, but need advice on the best way to approach this.

I considered going into each desktop switch, shutting down all not-in-use ports and then restricting the in-use ports to a single MAC. The problem is not all of the desktop flavors support this as readily as port-security on cisco enterprise devices. I considered doing the port-security upstream at the 3750's but overall I wonder how larger offices handle this kind of problem and if there's an easier way to track if a new switch has been plugged in somewhere without proper authorization?

Thanks in advance!


Social engineering is one of the greatest risks associated with network security. Your first goal would be to present the ease of access to network resources and devices as a security risk. Depending on what kind of data your company deals with, you can schedule a PCI audit OR you can sell the idea of one to the higher-ups as a benefit to your company's customers.

Your second task should be to unify all the switch/router architecture and adopt a rolling password implementation. By this I mean, every so often someone needs to go into all the Cisco equipment and change the password to enter config mode.

Enable port security! Without port security, you are running the risk of someone causing a loop, plugging in non-authorized devices, and setting up servers on the inside that could easily span or smurf traffic!

Clear mac-table dyn

Clear port-security all

And then let the mac-add-table populate. Confirm what ports have dual mac addresses and enable switchport port-security max at a number suitable for the macs on a port.

You can then force the switch to send out traps to your SNMP program of choice using :

snmp-server enable traps port-security trap-rate

for switches. Here's more information for you : http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/20ewa/configuration/guide/conf/port_sec.html Note that the doc is for a catalyst 4500. You'll have to look up the commands specifically for the switch you'd be dealing with.

  • 2
    All good points, but "mac security" isn't remotely secure. Allowing 4 macs on a port does nothing to prevent random devices from being used; it just means there won't be more than 4. I would guess the majority of "desktop" switches are of the $50 netgear unmanaged variety. – Ricky Mar 6 '14 at 18:31
  • If mac security isn't enough, you could always close ports by default by entering the shut command in config mode but the suggestions only apply to cisco based equipment. Your best bet is to replace all existing switches with Cisco equipment. Refurbished Catalyst 2950's are fairly cheap. You don't want to be using unmanageable switches in an enterprise setting. – HAL Mar 6 '14 at 18:43
  • 1
    The issue here is one of policy... the company allows this behavior. One will need to change that policy first. MAC security will only go so far as your users are willing to obey the new rules. – Ricky Mar 6 '14 at 18:57
  • Yes, policy will need to be changed first and foremost. Present the risk of their current policy to them as evidence. – HAL Mar 6 '14 at 19:26
  • Thanks for the feedback guys. All of the desktop switches are manageable but their featuresets aren't equal across the board. We're definitely moving to normalize gear at branch offices. I think mac security will work w/ sticky addresses written to memory, locking down unused ports and centralizing distribution of gear so we can track deployment. Marking closed with this as an answer. – A L Mar 6 '14 at 21:06

If your environment uses Active Directory for domain authentication, you could investigate setting up a test bed to implement dot1x and freenac. See



  • There are others authentications server that can be used; for example: cisco ACS, freeradius etc. Please next time try to provide a more comprehensive answer (it is not sufficient to provide just links). – radtrentasei Mar 6 '14 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.