Authenticating trunk ports?

CSchaatsbergen — Mon, 11 Mar 2019 00:49:57 GMT

Hi all,

Perhaps a stupid question but I find myself unable to find a satisfying answer.

We have a couple of 3560 switches, all connected to 3750 stack. One of those 3560 switches is in a semi-open place place and I have been asked if that could be considered a security risk. Of course, it being in an open place is a risk, but if someone where to unplug the trunk connection to our stack and then plug it in another switch, what would happen?

Should/could we authenticate trunk ports/channel-groups? I have all switches configured to authenticate ssh login and network (mac based) against a radius server, but I have not configured authentication on the trunk ports as I have found descriptions that dot1x cannot be enabled on trunk ports.

Thanks in advance

Chris

Re: Authenticating trunk ports?

Farrukh Haroon — Sun, 20 Feb 2011 07:50:56 GMT

Hello

I would suggest the following:

>> Arrange for some physical enclosure (locked) or any other physical security control to ensure authorized access to the device. Any technical work-around or band-aid solution should only be temporary. What is someone just switches of your switches? DOS attack!! This could also be done by mistake, resulting in an unstructred threat.

>> Enable monitoring for these switches (ICMP,SNMP) so that you are alerted when they are unplugged.

>> Change the NATIVE VLAN from the default (VLAN 1)

>> Disable Trunk negotiation (ON mode)

Regards

Farrukh

topic Re: Authenticating trunk ports? in Network Access Control

Authenticating trunk ports?

Re: Authenticating trunk ports?