34
votes
How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?
MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a ...
- 93.4k
10
votes
Accepted
What's the difference between RADIUS and 802.1X Port-Based Authentication?
That's a lot of questions, so let's take them one by one.
What exactly is 802.1X Port-Based Authentication?
From Wikipedia :
IEEE 802.1X is an IEEE Standard for port-based Network Access Control
...
- 2,628
10
votes
Accepted
What's use of Port Isolation vs traditional VLANs?
Port isolation -also called private VLAN (thanks @Stuggi)- is a very useful feature for switches that connect end users.
In a typical network you will have many end-users computers grouped together ...
- 18.4k
8
votes
Accepted
Why is option 82 required for DHCP when you use `ip verify source port-security`?
How is this different than using port security or ip source guard alone and why is option 82 required for this to work?
When you add the MAC address source filtering to IP source guard using the ip ...
- 26.7k
7
votes
How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?
Use a VPN internally and treat the section of the network outside secure areas the same way you would treat the internet.
7
votes
Accepted
When switchport port-security violation protect( or restrict) is configured , how many times can the security policy be breached?
Yes, the restrict and protect modes can be violated any number of times without shutting down the port since they are not designed to do that; they will drop packets with unknown source addresses:
...
- 93.4k
7
votes
Accepted
Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and ...
- 93.4k
6
votes
Accepted
Will a Wi-Fi Access point affect maximum addresses configured via port-security
That depends on how the access point is configured. If it's configured as a router you'll only see one address of the access point itself, but if it's configured as a bridge between the wireless and ...
- 15.6k
5
votes
Accepted
Does port forwarding dmz to a 'dead ip' improve security for my lan?
If you don't configure port forwarding then your NAT box will just drop the packets. If you configure port forwarding or a DMZ forwarding to an unused IP address then incoming packets will trigger ARP ...
- 6,640
5
votes
Accepted
Cisco port security static vs sticky+static
The difference is pretty straightforward.
switchport port-security mac-address sticky
Will convert all dynamically learned MAC addresses to sticky MAC addresses so that you don't have to statically ...
- 6,440
5
votes
Accepted
Port Security Or 802.1X Authentication On Non-Server Network
The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the ...
- 70.4k
4
votes
How to find the end-device causing high cpu usage in a Cisco switch?
What is driving CPU usage in a Cisco switch is probably not a single end-device. Cisco switches can normally handle a full switching load without driving the CPU utilization unusually high. This is ...
- 93.4k
4
votes
Accepted
List of allowed mac addresses for port security
Go for IEEE 802.1x Port-Based Authentication. Port security was not really designed for that.
HTH
Adam
- 315
4
votes
How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?
Answer to your question = No.
I dont think there is one complete answer. The closest would be to have defence in depth.
Start as Ron Maupin suggested as having Physical access restricted. Then have ...
- 161
4
votes
Accepted
How does NAC or NAP enhance 802.1X?
802.1X does perform either a computer or a user authentication to allow the network access.
NAC is a generic term designing any form of Network Access Control.
Then 802.1X is one kind of NAC. I ...
- 364
4
votes
Accepted
Difference between "errdisable recovery interval 300" and "switchport port-security aging time 2"
The command errdisable recovery interval 300 helps to re-enable a err-disabled port automatically.
Generally, it means that a port ,which is currently in error-disable state for a specific reason (...
- 3,744
4
votes
Accepted
802.1X on wired networks
This is a well-known weakness of 802.1X. It protects well against casual misconduct but provides no full protection against a decided attack. You can somewhat reduce the weakness by combining 802.1X ...
- 70.4k
4
votes
Port security on a cisco switch - predefined source MAC address and maximum number of MAC addresses
Basically, yes. Defining a group of MAC addresses to an interface restricts the allowed MAC addresses to those defined in the group, which could be a group of one.
Cisco has documents to explain port ...
- 93.4k
3
votes
Accepted
How can I allow the same MAC address on different ports with port security?
Please allow me to join the discussion.
Why would you even want to allow your Laptop MAC address on all switch ports with port security ?
The port security feature is mainly meant to increase Layer ...
- 315
3
votes
How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?
No because MAC addresses are easily spoofed. 802.1x is the proper tool for the job. With 802.1x, one of the connections methods could be, when you connect (whether wireless or wired), you are sent ...
- 4,250
3
votes
Accepted
Dynamic ARP Inspection ports err-disable with %SW_DAI-4-PACKET_RATE_EXCEEDED
ip arp inspection limit rate 20
20 packets per second is really low. If there's a server on that port (or more than one system), 20 pps is nothing.
Update
I don't know what any hosts are on your ...
- 29.6k
3
votes
Switchport security best practises for Cisco IP Phones (Not subjective)
I'm not overly familiar with the IP phones other than I know they have the ability to pass traffic to a workstation beyond it, so while I'm pretty sure this answer will work, I offer no guarantees.
...
- 41
3
votes
Accepted
Is mac address aging just for dynamic/sticky mac addresses?
You can configure an interface to convert the dynamic MAC addresses to sticky secure MAC addresses and to add them to the running configuration by enabling sticky learning. To enable sticky learning, ...
- 1,530
3
votes
Accepted
Dynamic ARP Inspection - Does it check port in the binding database?
Will DAI take port into consideration when checking the binding in the database ?
Since you don't mention platform or code version, generally speaking, when a host moves from P1 to P2, the host will ...
- 26.7k
3
votes
Difference between "errdisable recovery interval 300" and "switchport port-security aging time 2"
switchport port-security aging time 2 - The MAC address will be removed from the table after 2 minutes of inactivity.
errdisable recovery interval 300 - The port will recover from a errdisable state ...
- 61
3
votes
Will all switches pass 802.1x EAP seamlessly? Any caveats?
802.1X EAP frames are supposed to only be used between the client (supplicant) and its uplink switch (authenticator). The authenticator then uses a higher layer protocol for communication with the ...
- 70.4k
3
votes
Sticky MAC - Not working/appearing in run config?
You also need to enter the "switch port-security" command so it would look like this:
interface GigabitEthernet1/0/1
description Servers
switchport access vlan 50
switchport mode access
...
- 113
3
votes
protection method that you need to know exact 3 or more ports to access network
The answer i was looking for is posted in comment by @Jesse P.
The method is called Port Knocking
- 41
2
votes
Does violation restrict still apply within same switch but different port
No, if I'm reading this right, a violation on the 5/0/8 doesn't "poison" the secure status of the address on 5/0/7. Doing so would allow port-security to be used as an easy DOS tool.
If the secure ...
- 331
Only top scored, non community-wiki answers of a minimum length are eligible