topic ISE - Securing witch port channel interfaces in Network Access Control

ISE - Securing witch port channel interfaces

BigK — Fri, 28 Aug 2020 17:58:46 GMT

Hello,

On my switch, I have all the switchports configured with ISE- 802.X. My question is how can I secure the interfaces that belongs to a channel-group ? Someone can easily unplug the port and plug in any device, and since there is not security on the port that may allow the device to connect to the network.

Example:

SW-C3850#

interface GigabitEthernet1/0/48
switchport access vlan 10
switchport mode access
channel-group 1 mode on
spanning-tree portfast
ip dhcp snooping trust
end

SW-C3850#

interface GigabitEthernet2/0/48
switchport access vlan 10
switchport mode access
channel-group 1 mode on
spanning-tree portfast
ip dhcp snooping trust
end

Thanks !!!

Re: ISE - Securing witch port channel interfaces

balaji.bandi — Fri, 28 Aug 2020 19:33:42 GMT

In terms of Security - we need to understand as below :

1. Physical Security

2. Network Security

3. Layer Security ---so on

If the Physical security breached - no one can help - it is a disaster - intruder can do anything.

coming back to your question - This port is part of Port-channel - so what will happen when the end-user device connected?

Re: ISE - Securing witch port channel interfaces

BigK — Fri, 28 Aug 2020 22:18:49 GMT

@balaji.bandi

That is the question - what will happen when the end-user device is connected to one of these ports?

Thanks!