Block a port ?

[jmb09]

Hello,

I have a wifi acces point connect to a switch C2960X.

Often people unplug cable and connect its equipments in place of this wifi acces point !

I was considering to configure port-security on this port, but i'm afraid to block all wifi trafic ... Is somebody ha s solution ?

Thanks

[MHM Cisco World]

If this AP is local mode central SWITCHING' then you can use port-secuirty in port

If this AP is flexconn then you can not use port-secuirty 

MHM

[jmb09]

Hello,

Thanks, i have severall ap of different model, this is a 1602I manage by a controler that is a 1832I

Is it possible with a port-security to shutdown the port if this AP is unplung ?

Thanks

[MHM Cisco World]

If it AP flex then  sorry you can not use port-secuirty' do yoh have ISE ? You can use ISE to auth AP.

MHM

[jmb09]

Hi!

No i haven't it but it seems to be interresting .....

Thanks

[jmb09]

Hi

is there a way if a port is unplug to shudown the port and not activate it when cable is plug again, may be i was wrong by using port-security ?

Thanks

[MHM Cisco World]

only port-security can do that and hence AP is flex if you run port-secuirty it will drop traffic of wifi endpoint 

MHM

[jmb09]

Hi

Ok i well udestand i will take a look with my resailer next year, it should come install new accex point ....

Thank you for your time and your patience have a nice day ....

Thanks

[Flavio Miranda]

@jmb09 

 Port-security is an alternative in many scenarios. Do you have a Wireless Lan Controller or this is some kind of stand alone (Mobility express) Access Points? 

[jmb09]

Hi !

Yes at this time i have mobility express available and running, it's managing have 18 access point.

Mobility express version is now old (8.5.140.0) and we will renew 7 accesspoint in january, i hope having another version ...

Thanks

[Flavio Miranda]

@jmb09 

 For your scnerio, I dont believe you can justify ISE implementation, which should be the ideal for network security. But, If I were you I would take a close look on the  Auto Smartports feature available on your switch.

Auto Smartports Configuration Guide, Release 15.0(1)SE - Auto Smartports and Static Smartports Macros [Cisco Catalyst 3750-X Series Switches] - Cisco

With a bit of study and tests, you may  come up with something to protect the Access Point against arbitrary disconnection.