topic Blocking users using mac address in Network Security

Blocking users using mac address

prince.ibe — Mon, 11 Mar 2019 16:31:19 GMT

I have some users on our corporate network who I need to block from the network using mac address. I can't do this via dhcp because the users are using static IPs which they keep changing once it is blocked on the PIX 515E using the shun command.

How can I block access to these users on the PIX. The PIX is the default gateway.

Re: Blocking users using mac address

andrew.prince — Mon, 26 Oct 2009 15:34:18 GMT

You cannot block by mac-address on the PIX.

HTH>

Re: Blocking users using mac address

Kureli Sankar — Mon, 26 Oct 2009 15:58:22 GMT

Andrew is right. You cannot block based on the mac-address on the PIX but, you can see if you can do this on the switch side using mac access-list

http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_example09186a0080470c39.shtml

Re: Blocking users using mac address

andrew.prince — Mon, 26 Oct 2009 16:09:30 GMT

You could also consider configuring your switch to0 use VMPS, depends on your switch platform.

If you do implement VMPS - you can create a specific VLAN for these users, then either block by IP address or route them into a black hole for non lAN traffic.

Re: Blocking users using mac address

prince.ibe — Mon, 26 Oct 2009 19:41:35 GMT

I have a slightly complex situation at the moment which I hope to solve in the near future.

I inherited a flat network. No VLANs. No DMZ. In fact, the PIX acts as the LAN gateway with only 2 ports - one inside the other outside to a router which connects to the internet via vsat modem.

I hope to implement some control soonest using websence but before then, I am up to my chin troubled about this particular user that frequently changes his static IP and throttles the network badly.

What other method can I readily deploy to cut him permanently off the network? ...

Re: Blocking users using mac address

andrew.prince — Mon, 26 Oct 2009 19:47:28 GMT

you can use private vlans - see the below url for config examples:-

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a008013565f.shtml

Put this guy's switch port in a seperate VLAN and control him this way.