How to Prevent MAC Spoofing on catalyst switch 2960

[Rajeev Ranjan]

Hi Friends,

In my organisation some people change its own mac-address to known mac-address which are permitted through pot security, and use restricted network resources. How can i prevent this type of unauthorized access on cisco catalyst 2960 switch.

Is there any way to bind ip and mac, both parameter should be checked for access.

Kindly Help

[Leo Laohoo]

Use Active Directory to lock out what each user can and cannot do. 

[Somasundaram Jayaraman]

Hi,

Can you try configuring mac-access-lists.

Sample config:

============

mac access-list extended MAC_ACL_MATCH_BADHOSTS

permit host any

permit any host

vlan access-map VLAN_ACCESSMAP_BLOCK_BADHOSTS 10

action drop

match mac address MAC_ACL_MATCH_BADHOSTS

vlan access-map VLAN_ACCESSMAP_BLOCK_BADHOSTS 20

action forward

vlan filter VLAN_ACCESSMAP_BLOCK_BADHOSTS vlan-list 4

useful link:

=========

- http://www.cisco.com/en/US/products/hw/switches/ps64/products_configuration_example09186a0080470c39.shtml

Hope this helps

Cheers

Somu

Rate helpful posts

[Peter Paluch]

Hi everyone,

As the 2960 Catalysts support DHCP Snooping, IP Source Guard and Dynamic ARP Inspection in recent IOSes, I would personally vouch for DHCP Snooping + IP Source Guard.

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_58_se/configuration/guide/swdhcp82.html

Best regards,

Peter

[Rajeev Ranjan]

HHi Peter,

I tried IP Source Guard, but my switch is not supporting ip verify source or ip verify source port-security command. I am using 12.2(37)SE1 image on 2960G platform.

[Peter Paluch]

Hello,

The DHCP Snooping and IPSG should be supported since 12.2(52)SE. Are you able to upgrade to this or more recent IOS version?

Best regards,

Peter

[Ghulam zainulabideen]

Dear Peter Paluch,

We are using Cisco 2960G Switches in my organisation with IOS version

"

Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 12.2(44)SE6, RELEASE SOFTWARE (fc1)"

as this IOS not Support IP SOURCE GUARD feature....plz  tell me how can i download version 12.2(52)SE or any latest IOS. that can be upgrade and compatible with our 2960G Switches.

thanks in advance.

[devils_advocate]

As said by Peter, you need to be on 12.2(52)SE and yours is 12.2(44)SE6 so an IOS upgrade is needed on each switch you want to use these features on.

In order to get later IOS' you need a Cisco smartnet contract which costs money.

Technically you are supposed to have each switch covered to do an upgrade on each but in the real world you only need one covered to get the IOS. Bear in mind, if you only get one switch covered to get the IOS and then proceed to upgrade all of them, Cisco will only support the one under contract (outside of the standard year warranty you get anyway)