Port Security between two switches using Trunk

[ysanadiga01]

Hi there,

Is it possible to use Port Security mechanism between two switch (3750 or 3560) ports while trunk has been configured? If it's not possible, is there any other way to ensure that no other Switch can be connected other then the one switch which has been configured/placed by a network engineer?

Thanks.

[Reza Sharifi]

Hi,

Yes, it could be enabled on trunk ports

from the config guide:

Port Security Configuration Guidelines

Follow these guidelines when configuring port security:

•Port security can only be configured on static access ports or trunk ports. A secure port cannot be a dynamic access port.

•A secure port cannot be a destination port for Switched Port Analyzer (SPAN).

•A secure port cannot belong to a Fast EtherChannel or a Gigabit EtherChannel port group.

Config guide:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_58_se/configuration/guide/swtrafc.html#wp1038546

HTH

[ysanadiga01]

Hi Reza,

Thanks for your answer.

I did read that guide but I'm getting an error.

I got two switches, both of them 3560. VTP is running between the switches and 5 vlans have been configured. There is a trunk configured between the switches on port 1 of both switches. Clients are connected on other ports.

How you would configure port security on this trunk port? Everyday different clients with different mac addresses are connected on other ports.

I tried to configure port security with mac address sticky but after a few clients the trunk port is shutdown.

Thanks.

Sent from Cisco Technical Support iPad App

[Peter Paluch · Accepted solution]

Hello ysanadiga01 and Reza,

Reza: Although the Port Security can be configured on trunk ports, I believe that the original poster is asking about a different issue - how to prevent an unauthorized switch to be connected to a network. Port Security is not the correct tool to be used here.  While Port Security is concerned with MAC addresses, the switch does  not alter the MAC addresses of frames passing through it. Regardless of the switch connected to the protected port, there  is nothing in the frames that could help identify if the connected  switch is authorized or not.

You could theoretically do 802.1X authentication, with one switch authenticating to the  other. Cisco calls this feature NEAT. I have a feeling that the MACsec could also help here although I  am not quite sure about it as I have not had yet the opportunity to play with that.

Regarding the switch authenticating itself to another via NEAT 802.1X, this is the link:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/15.0_2_se/configuration/guide/sw8021x.html#wp1473337

Best regards,

Peter

[ysanadiga01]

Hi peter,

Thanks for your answer. I think that I can solve my situation with NEAT

Sent from Cisco Technical Support iPad App