Restrict Authentication

[mortezasadeghi]

Hi

Can we Restrict a client to authenticate on just one physical port?

that's mean the client cannot change its own physical port on a switch.

[Dennis Mink]

you would need to set up dot1x authentication, port based

[mortezasadeghi]

---

hi  Dennis Mink

I know.

But I'm asking how can I restrict the user. When they change their physical port, their device will not be authenticated.

[balaji.bandi]

We need to know your environement, Do you have ISE or any Authentication in your environment. then @Dennis Mink  suggested how you can do, 

If not only MAC Filter can help you.

[mortezasadeghi]

We have Cisco ACS

[Mike.Cifelli · Accepted solution]

You have a couple of options. The easy thing would be to do port security on the physical interface. However, port security & 8021x typically are not the best when playing together and in my opinion most people would say not to use both together. You could have your policy server deploy policy as you would with ISE or ACS. I think in order to meet your requirement you could eliminate relying on ISE/ACS and statically configure your one port for you one host with whatever policy you want to include vlan etc. You could then configure the other ports on the switch to use policy from AAA server & ensure the one host you do not want to migrate is not a part of any groups on the AAA server so even if the host moved from one interface to another it would fail authentication/authorization and no longer be on the network.