11 votes
Accepted

What's the difference between RADIUS and 802.1X Port-Based Authentication?

That's a lot of questions, so let's take them one by one. What exactly is 802.1X Port-Based Authentication? From Wikipedia : IEEE 802.1X is an IEEE Standard for port-based Network Access Control ...
hertitu's user avatar
  • 2,658
10 votes
Accepted

What's use of Port Isolation vs traditional VLANs?

Port isolation -also called private VLAN (thanks @Stuggi)- is a very useful feature for switches that connect end users. In a typical network you will have many end-users computers grouped together ...
JFL's user avatar
  • 19.7k
8 votes
Accepted

Why is option 82 required for DHCP when you use `ip verify source port-security`?

How is this different than using port security or ip source guard alone and why is option 82 required for this to work? When you add the MAC address source filtering to IP source guard using the ip ...
YLearn's user avatar
  • 27.3k
7 votes
Accepted

Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?

As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and ...
Ron Maupin's user avatar
  • 99.6k
6 votes
Accepted

Will a Wi-Fi Access point affect maximum addresses configured via port-security

That depends on how the access point is configured. If it's configured as a router you'll only see one address of the access point itself, but if it's configured as a bridge between the wireless and ...
Teun Vink's user avatar
  • 17.4k
5 votes
Accepted

Cisco port security static vs sticky+static

The difference is pretty straightforward. switchport port-security mac-address sticky Will convert all dynamically learned MAC addresses to sticky MAC addresses so that you don't have to statically ...
Jordan Head's user avatar
  • 7,099
5 votes
Accepted

Does port forwarding dmz to a 'dead ip' improve security for my lan?

If you don't configure port forwarding then your NAT box will just drop the packets. If you configure port forwarding or a DMZ forwarding to an unused IP address then incoming packets will trigger ARP ...
Sander Steffann's user avatar
5 votes
Accepted

Port Security Or 802.1X Authentication On Non-Server Network

The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the ...
Zac67's user avatar
  • 84.4k
4 votes
Accepted

How does NAC or NAP enhance 802.1X?

802.1X does perform either a computer or a user authentication to allow the network access. NAC is a generic term designing any form of Network Access Control. Then 802.1X is one kind of NAC. I ...
dan's user avatar
  • 364
4 votes
Accepted

List of allowed mac addresses for port security

Go for IEEE 802.1x Port-Based Authentication. Port security was not really designed for that. HTH Adam
cyzczy's user avatar
  • 315
4 votes
Accepted

Difference between "errdisable recovery interval 300" and "switchport port-security aging time 2"

The command errdisable recovery interval 300 helps to re-enable a err-disabled port automatically. Generally, it means that a port ,which is currently in error-disable state for a specific reason (...
Hung Tran's user avatar
  • 3,754
4 votes
Accepted

802.1X on wired networks

This is a well-known weakness of 802.1X. It protects well against casual misconduct but provides no full protection against a decided attack. You can somewhat reduce the weakness by combining 802.1X ...
Zac67's user avatar
  • 84.4k
4 votes

Port security on a cisco switch - predefined source MAC address and maximum number of MAC addresses

Basically, yes. Defining a group of MAC addresses to an interface restricts the allowed MAC addresses to those defined in the group, which could be a group of one. Cisco has documents to explain port ...
Ron Maupin's user avatar
  • 99.6k
4 votes

How does leaving a TCP connection half-open makes SYN and SYN+ACK stealth and absent from the logs?

There is no mandate, but the most common operating systems log only when the connection is fully established. As for the reason for that decision, you would have to ask the software authors (...
Ron Trunk's user avatar
  • 67.5k
3 votes
Accepted

Is mac address aging just for dynamic/sticky mac addresses?

You can configure an interface to convert the dynamic MAC addresses to sticky secure MAC addresses and to add them to the running configuration by enabling sticky learning. To enable sticky learning, ...
Datagram.Network's user avatar
3 votes
Accepted

Dynamic ARP Inspection - Does it check port in the binding database?

Will DAI take port into consideration when checking the binding in the database ? Since you don't mention platform or code version, generally speaking, when a host moves from P1 to P2, the host will ...
YLearn's user avatar
  • 27.3k
3 votes

Difference between "errdisable recovery interval 300" and "switchport port-security aging time 2"

switchport port-security aging time 2 - The MAC address will be removed from the table after 2 minutes of inactivity. errdisable recovery interval 300 - The port will recover from a errdisable state ...
NineTail's user avatar
3 votes

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

No because MAC addresses are easily spoofed. 802.1x is the proper tool for the job. With 802.1x, one of the connections methods could be, when you connect (whether wireless or wired), you are sent ...
Ronnie Royston's user avatar
3 votes
Accepted

How can I allow the same MAC address on different ports with port security?

Please allow me to join the discussion. Why would you even want to allow your Laptop MAC address on all switch ports with port security ? The port security feature is mainly meant to increase Layer ...
cyzczy's user avatar
  • 315
3 votes

Will all switches pass 802.1x EAP seamlessly? Any caveats?

802.1X EAP frames are supposed to only be used between the client (supplicant) and its uplink switch (authenticator). The authenticator then uses a higher layer protocol for communication with the ...
Zac67's user avatar
  • 84.4k
3 votes

Sticky MAC - Not working/appearing in run config?

You also need to enter the "switch port-security" command so it would look like this: interface GigabitEthernet1/0/1 description Servers switchport access vlan 50 switchport mode access ...
Aidan Venn's user avatar
3 votes

protection method that you need to know exact 3 or more ports to access network

The answer i was looking for is posted in comment by @Jesse P. The method is called Port Knocking
Philip Scot's user avatar
2 votes
Accepted

MAC address table showing the same MAC address on one port

Your Cisco VoIP phone is also a switch which negotiates a trunk link with the switch to which it connects. It shows up on both VLANs because it is on both VLANs. This is normal behavior. This is the ...
Ron Maupin's user avatar
  • 99.6k
2 votes
Accepted

Why would you use port security mode “protect?”

It really depends on your philosophy and resources. You can quickly fill a switch log with violations, making it hard to troubleshoot real problems (switch logs can only be so big). You really need to ...
Ron Maupin's user avatar
  • 99.6k
2 votes

How can I allow the same MAC address on different ports with port security?

You probably will want to look into port-security sticky (dynamically learns the MAC) then configure aging to age out old MAC Addresses on each interface. You wont be able to have port security ...
veel84's user avatar
  • 403
2 votes
Accepted

MAC addresses of hosts that violate port-security

Error Logs are generated such as: %PM-4-ERR_DISABLE and %PORT_SECURITY-2-PSECURE_VIOLATION The port status is also changed from Secure-Up to Secure-Down. Updated: Port security learns unauthorized ...
ssedwards's user avatar
  • 100
2 votes

Dynamic ARP Inspection - Does it check port in the binding database?

What DAI does is to intercept and inspect all ARP request and reply packets on an untrusted port. If an ARP reply packet contains INVALID information/value (invalid IP_Address-to-MAC_Address, NOT ...
Hung Tran's user avatar
  • 3,754
2 votes

HP 2910 Port Security (send alarm SNMP)

Check the MIB, it should be in there. edit: findstr /i portsecurity *.mib has hits in hpicfFf.mib and hpicfFtrCo.mib.
Zac67's user avatar
  • 84.4k
2 votes
Accepted

Cisco port ACL for one IP

Hosts on the same vlan are not limited by the access list. Access-list extended neteng-se Permit tcp host 1.1.1.1 host 192.168.1.2 eq www Permit tcp host 2.2.2.2 host 192.168.1.2 eq 22 ...
Ron Trunk's user avatar
  • 67.5k

Only top scored, non community-wiki answers of a minimum length are eligible