Question Regarding MAC security Feature BP-470 48T

[plastiiq]

Hi all,

I'm not very experienced with these switches and these forums have always been very useful to me.

My question is:

Can I provide the switch a list of MAC addresses that are authorized to connect and pass traffic and drop everything else? I did some reading and it looked like I could do something like this however it seemed to be even more granular. By this I mean it seemed I was compelled to tell the switch which ports the MACs can talk to.

I was looking for some way to allow all authorized MACS to talk to all ports on this stack. Is this possible? Is there some document I may have missed that has this info?

Thanks very much in advance for your help!

 

[WillyHe]

Hi,

I have no experience with MAC security on these switches but what i know is.

- MAC address security was always possible by auto learning or providing a list of MAC addresses. For me this seems not maintenance friendly, you have to visit all switches again when there is a change in the allowed MAC table list.

- Since some time the same should be possible with EAPOL where the switch can check a MAC address on a radius server. This is easier to maintain due to a centralized db.

b.s.
WH

 

[Jynxx]

You CAN do that but it is kind of a pain.

When you enable MAC security it is by port, so if you enter MAC addresses manually you have to specify the port that it will be on.

So what you COULD do is manually enter each MAC on every port...so that would be X MAC address entries on each of the 48 ports.

Unless users are constantly moving around, not certain what benefit it would provide to do that however.

 

[WillyHe]

It is possible to set the switch in auto learning mode for some time and then stop this.
It is possible to allow one specific MAC address on a port or to allow a list of mac addresses on a number of ports.
It is also possible to upload the MAC address list to the switch.
But all this is difficult to maintain in a moving environment.

with the latest switch SW it should be possible to "authenticate against an allowed MAC address list on a radius server.