Port security - MAC Pool -per vlan MAC pools

[Izac ICT]

Dear All,

We would like to create pool of mac addresses of all our devices and assign them to the all ports and add new ones in the future. Let's say we have 100 devices, only these clients can connect and move around to different ports but if an unregistered device connects, it will not have access. Is it possible to create a mac address table/pool and assign to all ports and update when necessary? Or some other way? MAC ACL? Would it be possible to assign in Vlan level?

Could you please share example configs?

Thank you very much in advance.

Izac

[Mark Malone · Accepted solution]

Hi
thats really what ISE and ACS are used for and would be the best tool
just using the switch to do it maybe mac address sticky and set the maximum on it to whatever you need , its alot of overhead to manage though in cli , while ISE would do it by policy and pools etc


interface FastEthernet0/9
switchport access vlan 164
switchport mode access
switchport port-security maximum 8
switchport port-security mac-address sticky
switchport port-security mac-address 1234.5678.9012 vlan access
switchport port-security mac-address 1234.5678.9019 vlan access
srr-queue bandwidth share 1 30 35 5
priority-queue out
mls qos trust dscp
auto qos trust dscp
spanning-tree portfast
ip dhcp snooping limit rate 7

[Izac ICT]

Hello @Mark Malone

Thank you for the answer. How can I create a main list of mac addresses and assign them to all ports and update when necessary?

What I want is to create port security but registered devices can move around and connect to different ports.

Cheers,

Izac

[Mark Malone]

MAC access list maybe , that's the only other option i know , if your switch supports it

Theres an example in this
http://aconaway.com/2008/10/27/using-mac-access-lists/