Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?Is there any way to differentiate MAC address of an Access Point from that of a client?Sticky mac learning PC mac as vlan voice on Cisco 3750v2How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?How do we prevent loss of sensitive information from MAC spoofing?When a datagram moves through a network, do the MAC or IP addresses change?Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?MAC ACL and Network SecurityPossibility of recognising a computer in the network that has changed its mac address?Port Security Or 802.1X Authentication On Non-Server NetworkCisco/Meraki switch SFP compatibility and dual link
Energy of the particles in the particle accelerator
How did Arya survive the stabbing?
Is the destination of a commercial flight important for the pilot?
Different result between scanning in Epson's "color negative film" mode and scanning in positive -> invert curve in post?
India just shot down a satellite from the ground. At what altitude range is the resulting debris field?
How does buying out courses with grant money work?
Short story about space worker geeks who zone out by 'listening' to radiation from stars
How do I go from 300 unfinished/half written blog posts, to published posts?
Do the temporary hit points from the Battlerager barbarian's Reckless Abandon stack if I make multiple attacks on my turn?
Is this apparent Class Action settlement a spam message?
Unreliable Magic - Is it worth it?
Is oxalic acid dihydrate considered a primary acid standard in analytical chemistry?
How can a function with a hole (removable discontinuity) equal a function with no hole?
Term for the "extreme-extension" version of a straw man fallacy?
Implement the Thanos sorting algorithm
What is the best translation for "slot" in the context of multiplayer video games?
Inappropriate reference requests from Journal reviewers
Go Pregnant or Go Home
Method to test if a number is a perfect power?
How do we know the LHC results are robust?
Is HostGator storing my password in plaintext?
Is there a good way to store credentials outside of a password manager?
How to pronounce the slash sign
What is the intuitive meaning of having a linear relationship between the logs of two variables?
Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?
Is there any way to differentiate MAC address of an Access Point from that of a client?Sticky mac learning PC mac as vlan voice on Cisco 3750v2How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?How do we prevent loss of sensitive information from MAC spoofing?When a datagram moves through a network, do the MAC or IP addresses change?Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?MAC ACL and Network SecurityPossibility of recognising a computer in the network that has changed its mac address?Port Security Or 802.1X Authentication On Non-Server NetworkCisco/Meraki switch SFP compatibility and dual link
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
edited Mar 21 at 16:20
Ron Maupin♦
67.9k1369126
asked Mar 21 at 14:06
techkilljoytechkilljoy
286
add a comment |
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
edited Mar 21 at 16:20
Ron Maupin♦
67.9k1369126
asked Mar 21 at 14:06
techkilljoytechkilljoy
286
4
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
Mar 21 at 14:20
add a comment |
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
edited Mar 21 at 16:20
Ron Maupin♦
67.9k1369126
asked Mar 21 at 14:06
techkilljoytechkilljoy
286
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
mac-address port-security meraki
edited Mar 21 at 16:20
Ron Maupin♦
67.9k1369126
asked Mar 21 at 14:06
techkilljoytechkilljoy
286
edited Mar 21 at 16:20
Ron Maupin♦
67.9k1369126
asked Mar 21 at 14:06
techkilljoytechkilljoy
286
edited Mar 21 at 16:20
Ron Maupin♦
67.9k1369126
edited Mar 21 at 16:20
Ron Maupin♦
67.9k1369126
edited Mar 21 at 16:20
Ron Maupin♦
67.9k1369126
67.9k1369126
asked Mar 21 at 14:06
techkilljoytechkilljoy
286
asked Mar 21 at 14:06
techkilljoytechkilljoy
286
asked Mar 21 at 14:06
techkilljoytechkilljoy
286
286
4
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
Mar 21 at 14:20
add a comment |
4
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
Mar 21 at 14:20
4
4
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
Mar 21 at 14:20
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
Mar 21 at 14:20
add a comment |
1 Answer
1
active
oldest
votes
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered Mar 21 at 14:35
Ron Maupin♦Ron Maupin
67.9k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
Mar 21 at 15:01
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
Mar 21 at 15:05
@RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches.
– techkilljoy
Mar 22 at 14:24
1
You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to usebpduguardin case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces.
– Ron Maupin♦
Mar 22 at 14:35
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "496"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f57844%2fwill-the-sticky-mac-access-policy-prevent-unauthorized-hubs-from-connecting-to-a%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered Mar 21 at 14:35
Ron Maupin♦Ron Maupin
67.9k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
Mar 21 at 15:01
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
Mar 21 at 15:05
@RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches.
– techkilljoy
Mar 22 at 14:24
1
You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to usebpduguardin case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces.
– Ron Maupin♦
Mar 22 at 14:35
add a comment |
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered Mar 21 at 14:35
Ron Maupin♦Ron Maupin
67.9k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
Mar 21 at 15:01
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
Mar 21 at 15:05
@RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches.
– techkilljoy
Mar 22 at 14:24
1
You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to usebpduguardin case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces.
– Ron Maupin♦
Mar 22 at 14:35
add a comment |
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered Mar 21 at 14:35
Ron Maupin♦Ron Maupin
67.9k1369126
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered Mar 21 at 14:35
Ron Maupin♦Ron Maupin
67.9k1369126
edited Mar 21 at 14:50
answered Mar 21 at 14:35
Ron Maupin♦Ron Maupin
67.9k1369126
answered Mar 21 at 14:35
Ron Maupin♦Ron Maupin
67.9k1369126
answered Mar 21 at 14:35
Ron Maupin♦Ron Maupin
67.9k1369126
67.9k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
Mar 21 at 15:01
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
Mar 21 at 15:05
@RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches.
– techkilljoy
Mar 22 at 14:24
1
You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to usebpduguardin case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces.
– Ron Maupin♦
Mar 22 at 14:35
add a comment |
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
Mar 21 at 15:01
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
Mar 21 at 15:05
@RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches.
– techkilljoy
Mar 22 at 14:24
1
You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to usebpduguardin case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces.
– Ron Maupin♦
Mar 22 at 14:35
5
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
Mar 21 at 15:01
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
Mar 21 at 15:01
6
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
Mar 21 at 15:05
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
Mar 21 at 15:05
@RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches.
– techkilljoy
Mar 22 at 14:24
@RonMaupin I was thinking about the VOIP issue but had not thought it could generate 3 MACs. That is good to keep in mind. What I have seen so far are hubs, not switches which was why I was focusing on a multi-MAC solution vice BPDUs. However, you have me thinking I may want a multi tiered solution. Do you see any other way to handle hubs other than a sticky MAC limit of 3? Note that this is specific to Meraki switches which dont have the same port security functionality as other Cisco switches.
– techkilljoy
Mar 22 at 14:24
1
1
You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to use
bpduguard in case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces.– Ron Maupin♦
Mar 22 at 14:35
You can test your VoIP phones with a switch. You may see two MAC addresses (phone and PC) or you may see three MAC addresses (different, or the phone MAC address twice), depending on the phone model and configuration. You really want to use
bpduguard in case two switch interfaces somehow get connected together through a hub, creating a loop. You can also use port security and 802.1X. Most (all?) of your end-devices would negotiate full-duplex connections, but a hub would necessitate a half-duplex connection, so you can look for that, too, but do not force full duplex on the interfaces.– Ron Maupin♦
Mar 22 at 14:35
add a comment |
Thanks for contributing an answer to Network Engineering Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f57844%2fwill-the-sticky-mac-access-policy-prevent-unauthorized-hubs-from-connecting-to-a%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
4
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
Mar 21 at 14:20