Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [port-security]

Port security is a technique for securing switchports by restricting inrgess traffic by limiting the MAC addresses that are allowed to send traffic into the port.

3
votes
1answer
57 views

Port security on a cisco switch - predefined source MAC address and maximum number of MAC addresses

With port security on a Cisco switch, if you configure 1 source MAC address, does that also set the maximum MAC addresses to only one?
2
votes
0answers
50 views

OpenvSwitch port-security on physical interface

I want to secure ports on OVS and allow specific clients source MAC addresses to an interface, to improve security on my network, Here is my scenario: ovs box with 4 physical port, port1 connected ...
3
votes
1answer
287 views

Port Security Or 802.1X Authentication On Non-Server Network

I have a closed network of 3 switches and 40 computers. 35 of those computers (Windows 7 x64 Professional) need to be plugged into any of the 24 ports on 2 of the switches at any time depending on the ...
1
vote
1answer
61 views

Sticky MAC - Not working/appearing in run config?

Running 3 x 3850's stacked. On some interfaces I run the following commands: interface GigabitEthernet1/0/1 description Servers switchport access vlan 50 switchport mode access switchport port-...
2
votes
1answer
57 views

Firewall Rule 'Both Ways'

I'd like to think I have a good understanding of NAT and Firewall rules at a basic level, though please correct me if I'm wrong at any point. I've seen many products list their firewall requirements ...
1
vote
2answers
385 views

Will all switches pass 802.1x EAP seamlessly? Any caveats?

We have a selection of Unifi, Meraki and Arista switches. We're currently trying to sort out our 802.1x/RADIUS infrastructure It seems like Meraki has the best 802.1x support (e.g. supporting multi-...
1
vote
0answers
44 views

How an MKA key server decides if it shall use MACSec and how it announce that?

According to IEEE 802.1X-2010 the standard for defining MACSec Key agreement protocol Clause 9.6, that's how the key-server decides to use MACSec or no. Each participant advertises whether it is ...
3
votes
1answer
101 views

802.1X on wired networks

Suppose i'm protection physically accessible RJ45 sockets in offices that are connected to a switch (Cisco SF220) with 802.1X port based authentication and a radius server. Authorized devices have ...
0
votes
2answers
60 views

Simplest explanation of ports, sockets, processes [closed]

Can anyone explain the simplest definition of what ports, sockets and processes are and what is the relationship between all 3. Thanks in advance.
0
votes
2answers
20 views

Security requirements for opened port? [closed]

I am a programmer and wanted to open a port for example 34000 on my public server, that my customer could use it. What kind of security concerns that I would face?
4
votes
1answer
2k views

What's use of Port Isolation vs traditional VLANs?

I've seen several switch products advertising port isolation feature as "way to limit ports communication without configuring VLANs" and it sounds quite... sketchy? If i understand it correctly port ...
2
votes
0answers
194 views

MAC ACL and Network Security

My company wanted to prevent rogue PCs from being connected to our network as our server room was shared between us and our clients in one of our sites. Network access was allowed only for our company ...
3
votes
1answer
76 views

MAC addresses of hosts that violate port-security

Do hosts that violate port-security show up in the mac-address table, or is this only in the logs? What would the log entry look like that has the violating address? We're on Cisco 2960X.
5
votes
1answer
590 views

Why is option 82 required for DHCP when you use `ip verify source port-security`?

Learning about security features on Cisco switches and came across the requirement to use option 82 with DHCP when you enable ip verify source port-security on an interface. How is this different ...
3
votes
2answers
449 views

Difference between “errdisable recovery interval 300” and “switchport port-security aging time 2”

Just wished to know the difference between - "errdisable recovery interval 300" and "switchport port-security aging time 2" In what scenarios are they used? I have seen that "switchport port-...
3
votes
2answers
327 views

Dynamic ARP Inspection - Does it check port in the binding database?

It is mentioned that DAI check for correct IP/MAC combination using the DHCP binding database. It is also mentioned that DAI is turned on for an entire VLan and not on a per port basis. If PCA (macA,...
4
votes
1answer
1k views

Cisco port security static vs sticky+static

I don't see a different between the two. Both make it to the running config. 1) sticky + static Switch1(config-if)#switchport port-security mac-address sticky ? H.H.H 48 bit mac address Switch1(...
0
votes
1answer
238 views

HP 2910 Port Security (send alarm SNMP)

I'm looking for correct "OID Value" when security port send alarm. I will see its in my SNMP logs. Edit: I forgot to mention, i already download this MIB but i didn't find the correct OID
-1
votes
0answers
84 views

Port-Security errdisables port?

I've got switch which is carrying links from all management ports of network devices - I gave him a name: Management-Switch. Switch A is connected to management switch using management port with MAC ...
1
vote
1answer
36 views

Cisco port ACL for one IP

I'm running cisco WS-C4948-10GE (MPC8540) and having a vlan configured as following: ip address 192.168.1.1 255.255.255.248 My question is, How to create an ACL to limit the connections for ports 80 ...
1
vote
1answer
79 views

Regarding the port security violation mode protected, what action needs to be taken when a new device replaces an old device?

If I turn on port security and configure a port with the following; the violation mode to protected, the ageing time to 10 minutes, maximum number of mac addresses to 1. If in the future I replace ...
1
vote
1answer
1k views

Is mac address aging just for dynamic/sticky mac addresses?

Regarding Cisco port-security. Is mac address aging just for dynamic/sticky mac addresses? Does the ageing play any part in a statically configured mac address? If no static or sticky configuration ...
1
vote
1answer
229 views

What is the ports that I should close in firewall to protect my LAN?

I use a firewall with two interfaces to protect my network but I don't know witch ports to close or open in LAN and WAN interface ? thanks for your help !!
1
vote
2answers
177 views

Shut down the port when someone plug out the cable

We have Cisco Catalyst 2960-S switches, And we noticed some employees plug out the internet cables to connect them to their Lab top. I want the command that I can use to make the port shutdown when ...
3
votes
1answer
605 views

How does NAC or NAP enhance 802.1X?

I'm studying about 802.1X port based authentication and RADIUS, and I came across the terms of NAC (Network Admission Control) and NAP (Network Access Protection). As long as I know NAC tries to unify ...
4
votes
2answers
21k views

What's the difference between RADIUS and 802.1X Port-Based Authentication?

As long as I know RADIUS is a type of authentication protocol, where for example if someone wants to use a switch, it first of all needs to enter his/her credentials, and properly authenticate himself/...
1
vote
1answer
1k views

Configuring a sticky MAC address on IOS

What is the use case of the Switch(config-if)# switchport port-security mac-address sticky 0000.1111.1111 command? By definition, a sticky address is a learned secure address that is added to the ...
0
votes
1answer
693 views

Is there a way to automatically have unused ports disable?

Like many others I can see how to display ports that have no traffic flowing through them and go through and disable them but we have hundreds of cisco switches. I like the idea of being able to see ...
1
vote
4answers
750 views

Alcatel OS6250 - How to allow devices on only one port

I'm currently working with Alcatel OmniSwitch 6250 switches and I was asked to find a blocking method so that an access point can only be plugged on one port of the 24 available. I looked at the "CLI ...
1
vote
1answer
52 views

How to test outoing traffic on random ports? (on OS X) [closed]

In some situations or on some locations, I'm struggling with restricted outgoing traffic. For example a restricted LAN where outgoing traffic is only allowed on limited ports. I know how to check or ...
1
vote
1answer
59 views

For how much period does the NAT table entry stays there even after connection is closed?

Yesterday, I was reading about the NAT then, during that time I endup with above doubt, I am thinking that if some application from private network makes call to outside world i.e. public network ...
1
vote
1answer
594 views

List of allowed mac addresses for port security

Want to be sure I'm approaching this correctly. I want to have a list of allowed MACs that can access any switch company wide (these devices can plug into any switch and be allowed access). To do ...
2
votes
1answer
142 views

Does port forwarding dmz to a 'dead ip' improve security for my lan?

Since there are many evil characters on the net scanning ports and ip blocks programmatically, can I misdirect an attempt to break into my system by setting the dmz port to a dead ip address or ...
1
vote
3answers
7k views

How can I allow the same MAC address on different ports with port security?

How can I allow my laptop MAC address on every port with port security? Is it even possible? When I try, I get this: SW2(config-if)#switchport port-security mac-address XXXX.XXXX.XXXX Found ...
1
vote
1answer
975 views

MAC address table showing the same MAC address on one port

When I try the sh mac address-table int gi 1/0/19 command: sh mac address-table int gi 1/0/19 Mac Address Table ------------------------------------------- Vlan Mac Address Type ...
2
votes
1answer
241 views

Why would you use port security mode “protect?”

Port security offers three violation mode options: • protect—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value....
4
votes
1answer
433 views

Will a Wi-Fi Access point affect maximum addresses configured via port-security

I want to configure port-security on a c2960 cisco switch to allow maximum of 10 MAC addresses per port. However two of the switch ports will be connected to a Wi-Fi access point for wireless users. ...
3
votes
2answers
484 views

Is it 'safe' to open port 80 for web hosting? [closed]

I am new to this whole section of hosting services. I looked up online on how to self host my website, and all the websites told me to set up the software (Apache server) and open port 80 to make my ...
1
vote
1answer
734 views

How to find the end-device causing high cpu usage in a Cisco switch? [closed]

While checking: sh proc cpu history there is high CPU utilization which occurs at a particular time.
1
vote
1answer
75 views

Basic questions regarding port numbers and firewall

I was studying about how port numbers work and got few questions as follows(sorry but I'm a noob and new to networking stuff but quite interested to learn all this :D )- 1. Where all does firewall ...
3
votes
1answer
9k views

When switchport port-security violation protect( or restrict) is configured , how many times can the security policy be breached?

The switchport port-security violation shutdown , shuts the port (err-disabled) when the policy is violated. But, for restrict and protect modes there isn't a mention of shutting a port down. So, can ...
0
votes
2answers
56 views

what are the parameter need to check out before shutting down the switch port? [closed]

If a switch is running in the live network and a port of it was in use before now.so I wants to shut it down. what are the parameter / things I need to check ?
31
votes
8answers
6k views

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

Is MAC address filtering the most suitable option to prevent someone connecting their own device to the network by plugging into Ethernet wall sockets? What if they unplug a device and clone its MAC?
3
votes
3answers
9k views

Dynamic ARP Inspection ports err-disable with %SW_DAI-4-PACKET_RATE_EXCEEDED

Ports in my network on random switches(connected to Windows 7 workstations) are going into err-disable because of dynamic arp inspection. Ports are going into err-disable because there are too many ...
1
vote
2answers
1k views

Switchport security best practises for Cisco IP Phones (Not subjective)

I am having some trouble figuring out what the most secure method is to secure a Cisco IP Phone. I can't find information on how to properly secure the Link between a switchport and a Cisco IP Phone, ...
2
votes
1answer
167 views

Does violation restrict still apply within same switch but different port

If I have a educational lab that's commonly used for multiple computers for teaching networking. I'm worried that if they remove the computer to put it in the classroom networking gear and come back ...
1
vote
1answer
421 views

where does cisco switches store dynamically learned secure mac addresses?

we all know that if we use the command show port-security address we'll see the entire table of secure mac addresses. I need to know which file does IOS use to store these addresses (specifically ...
5
votes
1answer
877 views

Sticky mac learning PC mac as vlan voice on Cisco 3750v2

I have port security configured as follows: switchport access vlan 196 switchport mode access switchport port-security switchport port-security aging time 3 switchport port-security violation ...
1
vote
2answers
326 views

How to track un-authorized devices being connected to a private network?

The culture at one of our main branch offices is very open and loose. Historically when people have needed more ports in their space they could just grab a switch from someone with access to our ...