topic Re: Port Lockdown to 1 MAC in Switches, Hubs, and Modems

Port Lockdown to 1 MAC

Tony Barrett_2 — Fri, 20 Oct 2006 08:14:43 GMT

I want to enforce our 2600 series switch's to only allow 1 MAC address per port. I don't mind what this MAC address is, but I don't want it to allow a second MAC to be learnt.

I've looked at the manuals, and I can nominate a single MAC to a port, or restrict an IP subnet to a switch port, but I can't obviously see a way to say 'only allow one MAC address on this port'. I don't mind if this is a global switch setting.

The idea behind this being to stop users plugging in hubs and sharing ports!

Thanks.

Re: Port Lockdown to 1 MAC

Matt Hobbs — Fri, 20 Oct 2006 08:36:35 GMT

Hi Tony,

I believe this should do what you're after:

2600(config)#port-security learn-mode limited-continuous address-limit 1

The only problem is when you get someone who plugs in a router that does NAT, as it will still appear as only the one mac-address...

Matt

Re: Port Lockdown to 1 MAC

Les Ligetfalvy — Fri, 20 Oct 2006 15:25:53 GMT

Those nasty consumer DSL routers... they make it so easy to clone MAC too. I am always vigilant of MAC OUI but when they clone the MAC of their accepted PC, it gets harder to catch them.

Re: Port Lockdown to 1 MAC

Tony Barrett_2 — Mon, 23 Oct 2006 04:13:36 GMT

Thanks for the prompt reply Matt, and sorry for not getting back to you sooner. Guess I was looking in the wrong place in the manual.

Your suggestion I think will enforce what I need, but I forgot to mention I want to use this 'single MAC per port' option with 802.1x authentication, which seems to cause a problem.

If I enter the suggested command with 802.1x auth enabled on the same port (e.g. 1), then I get the following error;

2600(config)# address-limit: Not allowed in current learn mode

I've tried using the following which works;

2600(config)# port-security 1 learn-mode port-access action send-alarm

2600(config)# sh port-security

Port Learn-Mode Action
1 Port-Access (802.1x) Send Alarm

But I'm pretty sure this config will only notify with SNMP trap if there is a detected security breach. It won't restrict learning to a single MAC.