BLOCKING MAC ADDRESS THROUGHT THE ROUTER

[methusela]

HOW CAN I BLOCK THE MAC ADDRESS OF A DEVICE THROUGHT

THE ROUTER??

[methusela]

I do really know that Router does only layer three filtering but

here comes a situation where some strangers get the user name and password of

someone in the network team, connect their computers and log in with staff

id. with nbtstat -a 172.65.1.xx of the compu

ter i can see the mac address of the pc. i do know i can block such mac address fro

m the access point. but is there a way i can block it from the router?

[Joe Clarke]

You can't reliably do this unless the MAC is on the same subnet as your router.  In that case, you could configure IRB with MAC address filtering.  However, that's a lot of config change for something easily circumvented by adding an intermediate router (or changing the MAC).

What would be better is to dedicate a subnet or VLAN to management, and apply IP access-lists to prevent users from being able to connect to your device except from one of the allowed management IPs.