Port-security

[tklamb]

Here is my dilemma...I have a total of 10 POS terminals that are temporarily used on weekends and any of them could be connected to any of 5 live data jacks in a public area. I want to secure these jacks with port-security, can anyone tell me the best way to do this? I thought I could enter the 10 MAC's in each of the 5 ports and I would be golden but it appears you cannot have the same MAC statically configured on more that 1 interface...

Any thoughts?

thanks

 

[keithja]

Mac ACL?

 

[North323]

what is the concern? you can create an acl based on MAC...that way regardless of where they are plugged in, they can do there thing

http://www.cisco.com/en/US/products...s_configuration_example09186a0080470c39.shtml

 

[tklamb]

Of course... a MAC ACL, thanks all.

 

[tklamb]

OK so I did the MAC ACL... works good, permit the macs of the POS terminals deny everything else, applied it to the interfaces in. If I connect my laptop (which is not permitted)I manage to get an IP address (don't understand how) although I don't appear to have connectivity to anything.

Is this sufficient to deny access? I am kind of concerned that dhcp assigns an IP, even though there does not appear to be connectivity I would prefer a potential 'intruder' didn't get any IP information.

thoughts?

 

[burtsbees]

What is assigning dhcp? Is the port set for spantree portfast?

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[burtsbees]

Also, I assume you checked and it's not an APIPA...

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[DallasBPF]

can you post the config of your switch port that you have configured and the MAC acl?

------------------------------------
Dallas, Texas
Telecommunications Tech
CCVP, CCNA, Net+

CCNP in the works

 

[tklamb]

Here's my config. Thanks.

interface GigabitEthernet1/0/1
description 104D178L
switchport access vlan 90
switchport mode access
switchport nonegotiate
no logging event link-status
mac access-group beer_bins in
spanning-tree portfast
spanning-tree bpduguard enable
end

Extended MAC access list beer_bins
permit host 0014.5e14.0905 any
permit host 000d.60d6.4710 any
permit host 0014.5e0f.c327 any
permit host 000d.60d6.417a any
permit host 000d.60d6.47cb any
permit host 000d.60d6.409f any
permit host 0014.5e14.0aba any
permit host 000d.60d6.4223 any
permit host 000d.60d6.4423 any
permit host 000d.60d6.41b9 any
deny any any

 

[burtsbees]

Disable spantree portfast, dhcp will time out.

Temporary solution...

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!