topic Re: Lock Down IP-MAC-Physical Interface Binding on ASA 5505? in Network Security

Lock Down IP-MAC-Physical Interface Binding on ASA 5505?

luke.o'hare — Mon, 11 Mar 2019 15:20:17 GMT

Hi,

Is it possible to lock down an IP-MAC-Physical Interface binding similar to using port security or IP source guard on the physical ports of the ASA 5505? This is to prevent spoofing, man in the middle attacks and the connection of unauthorised devices on physical interfaces that will be patched to publicly accessible wall jacks.

I have tried making static MAC entries however this does not seem to be supported on the ASA 5505. I have also looked into the IP spoofing feature however this seems to be more for spoofing between VLANs (zones) than per physical interface.

Any suggestions will be greatly appreciated.

Cheers

Re: Lock Down IP-MAC-Physical Interface Binding on ASA 5505?

vikram_anumukonda — Sat, 18 Apr 2009 13:17:29 GMT

IP-MAC mappings are possible in transparent mode but not in routed mode.

You might have move mac-ip bindings to your switches I suppose

Re: Lock Down IP-MAC-Physical Interface Binding on ASA 5505?

JORGE RODRIGUEZ — Sat, 18 Apr 2009 15:41:13 GMT

Luke, beside Vikran suggestions, Im not aware you can lock down macs for the builtin switch in asa5505 as you would with switches at the port level for 802.1x port security, there are however other strategies to prevent ip spoofing by using uRPF.

have a look here

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00809763ea.shtml

HTH