Blocking users using mac address

[prince.ibe]

I have some users on our corporate network who I need to block from the network using mac address. I can't do this via dhcp because the users are using static IPs which they keep changing once it is blocked on the PIX 515E using the shun command.

How can I block access to these users on the PIX. The PIX is the default gateway.

[andrew.prince]

You cannot block by mac-address on the PIX.

HTH>

[Kureli Sankar]

Andrew is right. You cannot block based on the mac-address on the PIX but, you can see if you can do this on the switch side using mac access-list

http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_example09186a0080470c39.shtml

[andrew.prince]

You could also consider configuring your switch to0 use VMPS, depends on your switch platform.

If you do implement VMPS - you can create a specific VLAN for these users, then either block by IP address or route them into a black hole for non lAN traffic.

[prince.ibe]

I have a slightly complex situation at the moment which I hope to solve in the near future.

I inherited a flat network. No VLANs. No DMZ. In fact, the PIX acts as the LAN gateway with only 2 ports - one inside the other outside to a router which connects to the internet via vsat modem.

I hope to implement some control soonest using websence but before then, I am up to my chin troubled about this particular user that frequently changes his static IP and throttles the network badly.

What other method can I readily deploy to cut him permanently off the network? ...

[andrew.prince]

you can use private vlans - see the below url for config examples:-

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a008013565f.shtml

Put this guy's switch port in a seperate VLAN and control him this way.