topic Re: CISCO security-port Switch in Network Security

CISCO security-port Switch

Translator — Thu, 19 May 2022 15:17:39 GMT

Information on securing CISCO switchports.

I saw that it was possible to set more than one additional MAC address for a port, and if another MAC address connects, the packets are blocked.

Unfortunately I have a lot of PCs and servers, which becomes too long to enter all MAC addresses on each port. In addition, many PCs are rented, so a considerable number of MAC addresses would have to be changed.

Is it possible to connect a switch to a database, file or other that contains a list of MAC addresses that will be allowed on each port?

Thank you

Re: CISCO security-port Switch

Rob Ingram — Thu, 19 May 2022 15:29:40 GMT

@Translator @blaucournet you can use Cisco ISE with MAC Authentication Bypass (MAB).

You can create an endpoint identity group in ISE of MAC addresses and permit/deny traffic accordingly.

Re: CISCO security-port Switch

Jitendra Kumar — Fri, 20 May 2022 05:30:50 GMT

@Translator @blaucournet As I believe you can not connect switch with database for the mac filtering.

1. you can set the Max mac limit.

example :-Switch(config-if)# switchport port-security maximum 10

for achieve your goal you have to put other solution like @Rob Ingram have suggest.

Thanks,

Jitendra

Re: CISCO security-port Switch

Translator — Thu, 26 May 2022 02:37:22 GMT

Hello

The best way is to use ISE which will be the database and in which you can import all your mac addresses or use authentication methodologies other than mac.

on older switches, VMPS was used as the ancestor of the mab authentication.

Thank you