Port security on Switch Cisco 2960

[sopheak yem]

Dear all,

I have 10 cisco switches installed for each floor and enable port security service for all switches.

1. Can i protect all PC/Labtop from outside to plug in my Switch in office ?

2. Can i allow all PC/Labtop of company only to plug in all switch in each floor ?

thanks so much for advance.

best regards,

sopheak

[Mark Malone]

Hi

1 yes with mac security

2 yes you can have multiple macs per port allowed

if you planning that its a lot of manual administration ISE will allow you to centrally manage options like that

[sopheak yem]

Dear Mark,

ISE is other hardware or application ? do we have other centralize easier that integrated in Cisco switch. 

thanks.

[Mark Malone]

Its an application like ACS which controls access to devices in enterprise networks ,the way your going to lock down every port to multiple mac address it takes a lot of administration , 10 switches at minimum is 240 ports that will need to manually administered ISE can automate a lot of it but it depends on cost as well whether its worth it

http://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/at_a_glance_c45-654884.pdf

[Scott Olsen]

You should be able to come up with some form of port based security that fits your needs.  I'd recommend you review Cisco's Network Security Baseline document.  In particular, Chapter 4 for the port-security detail.

http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/Baseline_Security/securebasebook/sec_chap4.html

Cheers!

[sopheak yem]

Thanks so much Olsen

I read already and not clear between "aging" and "sticky", could you share me more detail. One more thing all port security of switch seem to be manual . Do you have any advice for better recommendation?

switchport port-security aging type inactivity

switchport port-security mac-address sticky