Bypass Mac Filter

[Linkeichi]

I have this network.

How can i block the Internet traffic to the smarphones devices but not the traffic of the laptop?

Cause they are bypassing the Mac filter, due that his packets are encapsulated with the MAC of the netbook.

There is a way that forces the Switch or the router to read the packets and find that the destiny MAC is another one, and is not in the approved MAC Table?

[Karsten Iwen]

There are several ways, but not on the switch-level. For example:

1. MDM for the Laptops that turns off tethering for smartphones
2. MDM for smartphones that turns off tethering to non-authorized systems
3. Firewalls that recognize the OS of the requesting devide

[Linkeichi]

And any suggestion of a Router level commands?

[Karsten Iwen]

no, also not for the router.

[Linkeichi]

Then we can call a Win from the workers of the company if the IT department doesn't have a Firewall?, Cause that is what happen here!! the workers bypass with their tablets, Smartphones even their notebooks connected to that hotspot of the permitted MAC.

One question more, there is some Router that has a integrated Firewall, from the Cisco Solutions?

I saw here a 4600 or 4500, I want to get in TI and this contribution will help me to gain points.

[Karsten Iwen]

You should only call it a Win for the workers if there were any protection mechanisms. But MAC based filters are so weak and easily avoidable that they can't really be considered a protection mechanism.

For Firewalling, you need something that does next-generation firewalling. The firewall embedded in IOS is not enough.

[Linkeichi]

Then i'll suggest a next-gen firewall.

Any recommendation from Cisco one my friend?

[Karsten Iwen · Accepted solution]

There are two options from Cisco:

• Cisco ASA with FirePOWER
• Cisco Meraki MX

[Linkeichi]

Thank you, i appreciate so much your tracking.