Prevent rogue switch in the network?

[g.ska]

Hello everybody,

My question today:

Is there a way to authenticate a switch in the network? I'm looking for a solution to prevent rogue access switch. Is it possible to authenticate the switch itself? Via Cisco ISE, or other solutions?

For exemple:

if someone wants to connect a rogue access switch in the network in place of a "valid corporate switch" installed by IT team, I'd like the "upstream switch" automatically shutdown the port. (I don't talk about bpdugard because in this case it will not solved this kind of problem).

Do you have any idea to achieve this?

Thanks,

Greg.

[Milos Megis]

Hello,
some draft which could solve your problem, but I never implemented it.

Use dot1x authentication on switchport and some dynamic VLAN assignment.
So switchport will be in some isolated VLAN which doesn´t have routing to other parts of your network. And user must login to move port to specific VLAN.
So if user connect switch then it will be in isolated VLAN (from where he can get nowhere - it is not danger for your network) and when he would work then he must login and you have identified who is on that port.

Of course this suppose that nobody except IT staff has access to racks with your switches.

Maybe there is better solution. Try wait on other forum members. Maybe they advise something better.

One more solution: portsecurity with only one MAC address on port. So even somebody connect own switch, on your switch is allowed only one MAC address. So he could use only one port of own switch.

[Karsten Iwen]

For your first suggestion, there is a dedicated feature for that: NEAT (Network Edge Authentication Topology) authenticates a device connected to the Access-Port with 802.1x. If it is a corporate switch, then a special config is applied to make that switch behave as expected. If it's a "normal" user/device, the port is configured for that role. For an unknown switch, the behavior depends on the possibility of that device to pass EAPoL frames.