34 votes

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a ...
user avatar
  • 93.4k
10 votes
Accepted

What's the difference between RADIUS and 802.1X Port-Based Authentication?

That's a lot of questions, so let's take them one by one. What exactly is 802.1X Port-Based Authentication? From Wikipedia : IEEE 802.1X is an IEEE Standard for port-based Network Access Control ...
user avatar
  • 2,628
10 votes
Accepted

What's use of Port Isolation vs traditional VLANs?

Port isolation -also called private VLAN (thanks @Stuggi)- is a very useful feature for switches that connect end users. In a typical network you will have many end-users computers grouped together ...
user avatar
  • 18.4k
8 votes
Accepted

Why is option 82 required for DHCP when you use `ip verify source port-security`?

How is this different than using port security or ip source guard alone and why is option 82 required for this to work? When you add the MAC address source filtering to IP source guard using the ip ...
user avatar
  • 26.7k
7 votes

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

Use a VPN internally and treat the section of the network outside secure areas the same way you would treat the internet.
user avatar
7 votes
Accepted

When switchport port-security violation protect( or restrict) is configured , how many times can the security policy be breached?

Yes, the restrict and protect modes can be violated any number of times without shutting down the port since they are not designed to do that; they will drop packets with unknown source addresses: ...
user avatar
  • 93.4k
7 votes
Accepted

Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?

As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and ...
user avatar
  • 93.4k
6 votes
Accepted

Will a Wi-Fi Access point affect maximum addresses configured via port-security

That depends on how the access point is configured. If it's configured as a router you'll only see one address of the access point itself, but if it's configured as a bridge between the wireless and ...
user avatar
  • 15.6k
5 votes
Accepted

Does port forwarding dmz to a 'dead ip' improve security for my lan?

If you don't configure port forwarding then your NAT box will just drop the packets. If you configure port forwarding or a DMZ forwarding to an unused IP address then incoming packets will trigger ARP ...
user avatar
5 votes
Accepted

Cisco port security static vs sticky+static

The difference is pretty straightforward. switchport port-security mac-address sticky Will convert all dynamically learned MAC addresses to sticky MAC addresses so that you don't have to statically ...
user avatar
  • 6,440
5 votes
Accepted

Port Security Or 802.1X Authentication On Non-Server Network

The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the ...
user avatar
  • 70.4k
4 votes

How to find the end-device causing high cpu usage in a Cisco switch?

What is driving CPU usage in a Cisco switch is probably not a single end-device. Cisco switches can normally handle a full switching load without driving the CPU utilization unusually high. This is ...
user avatar
  • 93.4k
4 votes
Accepted

List of allowed mac addresses for port security

Go for IEEE 802.1x Port-Based Authentication. Port security was not really designed for that. HTH Adam
user avatar
  • 315
4 votes

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

Answer to your question = No. I dont think there is one complete answer. The closest would be to have defence in depth. Start as Ron Maupin suggested as having Physical access restricted. Then have ...
user avatar
  • 161
4 votes
Accepted

How does NAC or NAP enhance 802.1X?

802.1X does perform either a computer or a user authentication to allow the network access. NAC is a generic term designing any form of Network Access Control. Then 802.1X is one kind of NAC. I ...
user avatar
  • 364
4 votes
Accepted

Difference between "errdisable recovery interval 300" and "switchport port-security aging time 2"

The command errdisable recovery interval 300 helps to re-enable a err-disabled port automatically. Generally, it means that a port ,which is currently in error-disable state for a specific reason (...
user avatar
  • 3,744
4 votes
Accepted

802.1X on wired networks

This is a well-known weakness of 802.1X. It protects well against casual misconduct but provides no full protection against a decided attack. You can somewhat reduce the weakness by combining 802.1X ...
user avatar
  • 70.4k
4 votes

Port security on a cisco switch - predefined source MAC address and maximum number of MAC addresses

Basically, yes. Defining a group of MAC addresses to an interface restricts the allowed MAC addresses to those defined in the group, which could be a group of one. Cisco has documents to explain port ...
user avatar
  • 93.4k
3 votes
Accepted

How can I allow the same MAC address on different ports with port security?

Please allow me to join the discussion. Why would you even want to allow your Laptop MAC address on all switch ports with port security ? The port security feature is mainly meant to increase Layer ...
user avatar
  • 315
3 votes

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

No because MAC addresses are easily spoofed. 802.1x is the proper tool for the job. With 802.1x, one of the connections methods could be, when you connect (whether wireless or wired), you are sent ...
user avatar
3 votes
Accepted

Dynamic ARP Inspection ports err-disable with %SW_DAI-4-PACKET_RATE_EXCEEDED

ip arp inspection limit rate 20 20 packets per second is really low. If there's a server on that port (or more than one system), 20 pps is nothing. Update I don't know what any hosts are on your ...
user avatar
  • 29.6k
3 votes

Switchport security best practises for Cisco IP Phones (Not subjective)

I'm not overly familiar with the IP phones other than I know they have the ability to pass traffic to a workstation beyond it, so while I'm pretty sure this answer will work, I offer no guarantees. ...
user avatar
  • 41
3 votes
Accepted

Is mac address aging just for dynamic/sticky mac addresses?

You can configure an interface to convert the dynamic MAC addresses to sticky secure MAC addresses and to add them to the running configuration by enabling sticky learning. To enable sticky learning, ...
user avatar
3 votes
Accepted

Dynamic ARP Inspection - Does it check port in the binding database?

Will DAI take port into consideration when checking the binding in the database ? Since you don't mention platform or code version, generally speaking, when a host moves from P1 to P2, the host will ...
user avatar
  • 26.7k
3 votes

Difference between "errdisable recovery interval 300" and "switchport port-security aging time 2"

switchport port-security aging time 2 - The MAC address will be removed from the table after 2 minutes of inactivity. errdisable recovery interval 300 - The port will recover from a errdisable state ...
user avatar
3 votes

Will all switches pass 802.1x EAP seamlessly? Any caveats?

802.1X EAP frames are supposed to only be used between the client (supplicant) and its uplink switch (authenticator). The authenticator then uses a higher layer protocol for communication with the ...
user avatar
  • 70.4k
3 votes

Sticky MAC - Not working/appearing in run config?

You also need to enter the "switch port-security" command so it would look like this: interface GigabitEthernet1/0/1 description Servers switchport access vlan 50 switchport mode access ...
user avatar
3 votes

protection method that you need to know exact 3 or more ports to access network

The answer i was looking for is posted in comment by @Jesse P. The method is called Port Knocking
user avatar
2 votes

Does violation restrict still apply within same switch but different port

No, if I'm reading this right, a violation on the 5/0/8 doesn't "poison" the secure status of the address on 5/0/7. Doing so would allow port-security to be used as an easy DOS tool. If the secure ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible