Prevent WIFI router to connect to a switchport

[Vlad Olteanu]

Guys -

I have a question . We run port security everywhere with DHCP snooping and ARP inspection .

However , what if a user comes from home with his WIFI router , clones the MAC and connects it to the jack in his cubicle?

What's the prevention measure for this ?

Regards,

Vlad

[Wafron Darmawan]

Hi Vlad,

Did you find a solution for this? 

Thanks,

Wafron 

[Scott Olsen]

In my humble opinion, you could deal with it in a couple ways... some more reactive than others.

1) Use your corporate Wifi solution to perform some type of rogue AP detection (and potentially automated mitigation).  The corporate RF fabric can passively (or actively) monitor for beacons not under it's control and alert IT staff to their presence.  Depending on the rogue network and company RF infrastructure setup, it may even be automatically able to determine if the rogue AP is 'on-wire' and attached to the corporate LAN.  Again, the possibility to automatically shut the access port may also be available.

2) Far more administratively burdensome; Implement full blown 802.1X port security on the wired ports in your network in addition to your wireless network (right?).  Wired side 802.1X requires endpoints to authenticate before they can even pass traffic. In many cases, if an attacker has access to your network at Layer2, it may already be game over.