34
MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a lot of work for very little return.
You need a comprehensive security policy which can include such things as:
Physical access limitations
802.1X as @robut ...
10
Port isolation -also called private VLAN (thanks @Stuggi)- is a very useful feature for switches that connect end users.
In a typical network you will have many end-users computers grouped together in a VLAN that communicates with some servers in other networks.
Those computers have no need to communicate together, so it's best to block those unwanted ...
8
How is this different than using port security or ip source guard alone and why is option 82 required for this to work?
When you add the MAC address source filtering to IP source guard using the ip verify source port-security command, the client MAC address is not learned until it has obtained a DHCP lease. Until then, all non-IP traffic except for DHCP ...
7
Yes, the restrict and protect modes can be violated any number of times without shutting down the port since they are not designed to do that; they will drop packets with unknown source addresses:
See Configuring the Port Security Violation Mode on a Port on page 62-6:
protect—Drops packets with unknown source addresses until you remove a sufficient ...
7
That's a lot of questions, so let's take them one by one.
What exactly is 802.1X Port-Based Authentication?
From Wikipedia :
IEEE 802.1X is an IEEE Standard for port-based Network Access Control
(PNAC). It is part of the IEEE 802.1 group of networking protocols. It
provides an authentication mechanism to devices wishing to attach to a
LAN or WLAN.
...
7
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a ...
6
Use a VPN internally and treat the section of the network outside secure areas the same way you would treat the internet.
6
That depends on how the access point is configured. If it's configured as a router you'll only see one address of the access point itself, but if it's configured as a bridge between the wireless and the wired network, you'll see a MAC address for every connected client.
5
If you don't configure port forwarding then your NAT box will just drop the packets. If you configure port forwarding or a DMZ forwarding to an unused IP address then incoming packets will trigger ARP lookups on your LAN. Lots of wasted CPU cycles and lots of broadcast traffic on your LAN, and in the end the packets still get dropped...
And if you ask this ...
5
Social engineering is one of the greatest risks associated with network security. Your first goal would be to present the ease of access to network resources and devices as a security risk. Depending on what kind of data your company deals with, you can schedule a PCI audit OR you can sell the idea of one to the higher-ups as a benefit to your company's ...
5
The difference is pretty straightforward.
switchport port-security mac-address sticky
Will convert all dynamically learned MAC addresses to sticky MAC addresses so that you don't have to statically define them (like if you had a couple hundred hosts).
switchport port-security mac-address sticky ae11.be22.ce33
Simply allows you to ensure that one is added ...
5
The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the 2910's "Access and Security Guide" chapter 13. If you've got nothing local to use as a RADIUS server you'll need a router to connect elsewhere - however, you ...
4
Answer to your question = No.
I dont think there is one complete answer. The closest would be to have defence in depth.
Start as Ron Maupin suggested as having Physical access restricted. Then have 802.1x using EAP-TLS to have authentication to the port.
After that you can still have a firewall on the access/ditribution layer. If you are talking more ...
4
Go for IEEE 802.1x Port-Based Authentication. Port security was not really designed for that.
HTH
Adam
4
What is driving CPU usage in a Cisco switch is probably not a single end-device. Cisco switches can normally handle a full switching load without driving the CPU utilization unusually high. This is because the switching is largely handled in hardware.
The most likely cause is a service or protocol which the switch needs to handle in software. You didn't ...
4
802.1X does perform either a computer or a user authentication to allow the network access.
NAC is a generic term designing any form of Network Access Control.
Then 802.1X is one kind of NAC. I consider 802.1X to be the standard of NAC.
Beware here of the abbreviation collision around NAC which stands for Network Access Control and Network Admission ...
4
The command errdisable recovery interval 300 helps to re-enable a err-disabled port automatically.
Generally, it means that a port ,which is currently in error-disable state for a specific reason (including port-security violation), will be automatically re-enabled after 300 seconds. You can choose which kind of reason/cause that will re-activate the port ...
4
This is a well-known weakness of 802.1X. It protects well against casual misconduct but provides no full protection against a decided attack. You can somewhat reduce the weakness by combining 802.1X with MAC-port binding on the protected interfaces, but this can be overcome as well.
If you require better security take a look at MACsec defined by IEEE 802....
4
Basically, yes. Defining a group of MAC addresses to an interface restricts the allowed MAC addresses to those defined in the group, which could be a group of one.
Cisco has documents to explain port security, if you search. For example, Chapter: Configuring Port Security:
You can use the port security feature to restrict input to an
interface by ...
3
Please allow me to join the discussion.
Why would you even want to allow your Laptop MAC address on all switch ports with port security ?
The port security feature is mainly meant to increase Layer 2 security e.g. prevent MAC overflow attacks on a switch. It's not meant to prevent unauthorized devices to be connected to a RJ45 socket aka Ethernet port. ...
3
No because MAC addresses are easily spoofed. 802.1x is the proper tool for the job. With 802.1x, one of the connections methods could be, when you connect (whether wireless or wired), you are sent to a captive portal (aka splash page) via your browser where you can accept the terms of use, optionally enter a required password, etc.
3
I'm not overly familiar with the IP phones other than I know they have the ability to pass traffic to a workstation beyond it, so while I'm pretty sure this answer will work, I offer no guarantees.
How to secure against Double VLAN tagging and CDP attacks on that
port.
Your easiest way to protect against Double VLAN tagging, is to properly configure ...
3
ip arp inspection limit rate 20
20 packets per second is really low. If there's a server on that port (or more than one system), 20 pps is nothing.
Update
I don't know what any hosts are on your network (who's talking to who, and why), but for the minute at 13:14:34, 15 hosts asked who 89 was. And 89 asked who 5 hosts were. The request ~0.1sec before this ...
3
You can configure an interface to convert the dynamic MAC addresses to sticky secure MAC addresses and to add them to the running configuration by enabling sticky learning. To enable sticky learning, enter the switchport port-security mac-address sticky command. When you enter this command, the interface converts all the dynamic secure MAC addresses, ...
3
Will DAI take port into consideration when checking the binding in the database ?
Since you don't mention platform or code version, generally speaking, when a host moves from P1 to P2, the host will still process DHCP and the DHCP snooping binding table will update to reflect P2. So even if a particular implementation does check use the port there should ...
3
switchport port-security aging time 2 - The MAC address will be removed from the table after 2 minutes of inactivity.
errdisable recovery interval 300 - The port will recover from a errdisable state after 300 seconds.
Aging and errdisable are two different things.
3
802.1X EAP frames are supposed to only be used between the client (supplicant) and its uplink switch (authenticator). The authenticator then uses a higher layer protocol for communication with the authentication server. The higher layer protocol can be switched and routed as desired.
You cannot use 802.1X authentication across several switches. Essentially, ...
3
You also need to enter the "switch port-security" command so it would look like this:
interface GigabitEthernet1/0/1
description Servers
switchport access vlan 50
switchport mode access
switchport port-security
switchport port-security mac-address sticky
ip access-group xxxxxx in
spanning-tree bpduguard enable
Thanks
Aidan
2
user4608 said:
I was aware that rate limit is 20. What value would you recommend?
There is no one good answer to this question; you need to know your environment pretty well to know where to set the threshold.
Arguably, if you're still seeing err-disables at 50 DAI inspections per second, I'd keep bumping it in increments of 25 until you find something ...
2
Whenever someone asks what is the most secure way to do something, I always wonder if that's what they would really want if they consider the costs of doing so. Implementing security controls have a cost associated with them -- the additional time and effort it takes to implement, maintain and troubleshoot the security features, along with the effects they ...
Only top voted, non community-wiki answers of a minimum length are eligible
