Trjtdtk

Energy of the particles in the particle accelerator

How did Arya survive the stabbing?

Is the destination of a commercial flight important for the pilot?

Different result between scanning in Epson's "color negative film" mode and scanning in positive -> invert curve in post?

India just shot down a satellite from the ground. At what altitude range is the resulting debris field?

How does buying out courses with grant money work?

Short story about space worker geeks who zone out by 'listening' to radiation from stars

How do I go from 300 unfinished/half written blog posts, to published posts?

Do the temporary hit points from the Battlerager barbarian's Reckless Abandon stack if I make multiple attacks on my turn?

Is this apparent Class Action settlement a spam message?

Unreliable Magic - Is it worth it?

Is oxalic acid dihydrate considered a primary acid standard in analytical chemistry?

How can a function with a hole (removable discontinuity) equal a function with no hole?

Term for the "extreme-extension" version of a straw man fallacy?

Implement the Thanos sorting algorithm

What is the best translation for "slot" in the context of multiplayer video games?

Inappropriate reference requests from Journal reviewers

Go Pregnant or Go Home

Method to test if a number is a perfect power?

How do we know the LHC results are robust?

Is HostGator storing my password in plaintext?

Is there a good way to store credentials outside of a password manager?

How to pronounce the slash sign

What is the intuitive meaning of having a linear relationship between the logs of two variables?

Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?

Is there any way to differentiate MAC address of an Access Point from that of a client?Sticky mac learning PC mac as vlan voice on Cisco 3750v2How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?How do we prevent loss of sensitive information from MAC spoofing?When a datagram moves through a network, do the MAC or IP addresses change?Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?MAC ACL and Network SecurityPossibility of recognising a computer in the network that has changed its mac address?Port Security Or 802.1X Authentication On Non-Server NetworkCisco/Meraki switch SFP compatibility and dual link

3

We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.

From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.

Meraki switch port settings

Is this correct or have I missed something?

mac-address port-security meraki

share|improve this question

edited Mar 21 at 16:20

Ron Maupin♦

67.9k1369126

asked Mar 21 at 14:06

techkilljoytechkilljoy

286

• 
  
  
  

  
  4
  

  
  
  
  
  
  

  
  
  Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
  
  – Jesse P.
  Mar 21 at 14:20
  
  

  
  
  
  

add a comment | 

3

We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.

From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.

Meraki switch port settings

Is this correct or have I missed something?

mac-address port-security meraki

share|improve this question

edited Mar 21 at 16:20

Ron Maupin♦

67.9k1369126

asked Mar 21 at 14:06

techkilljoytechkilljoy

286

• 
  
  
  

  
  4
  

  
  
  
  
  
  

  
  
  Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
  
  – Jesse P.
  Mar 21 at 14:20
  
  

  
  
  
  

add a comment | 

We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.

From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.

Meraki switch port settings

Is this correct or have I missed something?

mac-address port-security meraki

share|improve this question

edited Mar 21 at 16:20

Ron Maupin♦

67.9k1369126

asked Mar 21 at 14:06

techkilljoytechkilljoy

286

share|improve this question

edited Mar 21 at 16:20

Ron Maupin♦

67.9k1369126

asked Mar 21 at 14:06

techkilljoytechkilljoy

286

share|improve this question

edited Mar 21 at 16:20

Ron Maupin♦

67.9k1369126

asked Mar 21 at 14:06

techkilljoytechkilljoy

286

edited Mar 21 at 16:20

Ron Maupin♦

67.9k1369126

edited Mar 21 at 16:20

Ron Maupin♦

67.9k1369126

asked Mar 21 at 14:06

techkilljoytechkilljoy

286

asked Mar 21 at 14:06

techkilljoytechkilljoy

286

1 Answer
1

active

oldest

votes

7

As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.

You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.

---

If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.

share|improve this answer

edited Mar 21 at 14:50

answered Mar 21 at 14:35

Ron Maupin♦Ron Maupin

67.9k1369126

• 
  
  
  

  
  5
  

  
  
  
  
  
  

  
  
  Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
  
  – Ricky Beam
  Mar 21 at 15:01
  

  
  
  
  


• 
  
  
  

  
  6
  

  
  
  
  
  
  

  
  
  Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
  
  – Ron Maupin♦
  Mar 21 at 15:05
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches.
  
  – techkilljoy
  Mar 22 at 14:24
  
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to use bpduguard in case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces.
  
  – Ron Maupin♦
  Mar 22 at 14:35
  
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "496"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f57844%2fwill-the-sticky-mac-access-policy-prevent-unauthorized-hubs-from-connecting-to-a%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

7

As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.

You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.

---

If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.

share|improve this answer

edited Mar 21 at 14:50

answered Mar 21 at 14:35

Ron Maupin♦Ron Maupin

67.9k1369126

• 
  
  
  

  
  5
  

  
  
  
  
  
  

  
  
  Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
  
  – Ricky Beam
  Mar 21 at 15:01
  

  
  
  
  


• 
  
  
  

  
  6
  

  
  
  
  
  
  

  
  
  Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
  
  – Ron Maupin♦
  Mar 21 at 15:05
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches.
  
  – techkilljoy
  Mar 22 at 14:24
  
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to use bpduguard in case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces.
  
  – Ron Maupin♦
  Mar 22 at 14:35
  
  

  
  
  
  

add a comment | 

7

As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.

You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.

---

If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.

share|improve this answer

edited Mar 21 at 14:50

answered Mar 21 at 14:35

Ron Maupin♦Ron Maupin

67.9k1369126

• 
  
  
  

  
  5
  

  
  
  
  
  
  

  
  
  Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
  
  – Ricky Beam
  Mar 21 at 15:01
  

  
  
  
  


• 
  
  
  

  
  6
  

  
  
  
  
  
  

  
  
  Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
  
  – Ron Maupin♦
  Mar 21 at 15:05
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches.
  
  – techkilljoy
  Mar 22 at 14:24
  
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to use bpduguard in case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces.
  
  – Ron Maupin♦
  Mar 22 at 14:35
  
  

  
  
  
  

add a comment | 

As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.

You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.

---

If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.

share|improve this answer

edited Mar 21 at 14:50

answered Mar 21 at 14:35

Ron Maupin♦Ron Maupin

67.9k1369126

share|improve this answer

edited Mar 21 at 14:50

answered Mar 21 at 14:35

Ron Maupin♦Ron Maupin

67.9k1369126

answered Mar 21 at 14:35

Ron Maupin♦Ron Maupin

67.9k1369126

answered Mar 21 at 14:35

Ron Maupin♦Ron Maupin

67.9k1369126