Cisco 3850 MAC-Based Access Control List

[adeebtaqui]

What is the best way to prevent any personal devices from accessing  wired network from access switches 

Is configuring MAC-Based Access Control List by permitting only authorized mac addresses on cisco 3850 a good solution?  

Or any other.

Please share your knowledge and experience.

[Seb Rupik]

Hi there,

MAC ACLs are not a very scalable solution. Implementing MAB would be the enterprise scale solution, but since MAC addresses can be spoofed, it is not the most secure.

You then travel down the path of 802.1x. Using just password authentication would allow to easily bind users to MAC addresses, but that wouldn’t stop them from bringing in their own devices and authenticating.

So you could look at implementing EAP-TLS and installing signed certificates onto the user devices. If these devices are managed, then it should be easy to push the certificates to them. Without a valid signed certificate user devices would not be able to authenticate.

It would take a pretty determined user to extract the signed cert and place it on their personal device!

Take a look at this document:

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec_1-99/Dot1X_Deployment/Dot1x_Dep_Guide.html#wp386952

Cheers,

Seb.

[adeebtaqui]

Can ISE be deployed for this purpose?

[Seb Rupik]

Yes, ISE is more than capable for this purpose.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01110.html#ID425

cheers,

Seb.