ACLs and MAC addresses

[andrea vian]

Hallo!
Is it possible to apply ACLs or filter network traffic on a MAC address basis, ie: is it possible to lock out unknown machines?
thanks!
Andrea

[Ernest Ford]

Yes it is possible BUT it depends on the kind of equipment you're using AND your network architecture.

[andrea vian]

Ernest,
thanks for your reply.
We've got a Procurve 5308XL with software version E.07.27, simple-default configuration and no VLAN.
We have a lot of visiting students' notebooks connecting to the Procurve switch and a win2003 DHCP server leasing IP addresses also connected to the switch.
I'd need to filter IP requests/offers on a MAC address basis, in order to allow access to the LAN only to known students' machines directly connected to the Procurve switch avoiding unknown machines or known machines not directly connected to the switch to get acces to the LAN.
Can you give a schematic idea of things to do and point me in the right direction?
Thanks a lot!
Andrea

[Ernest Ford]

Configure the server for bootp and not DHCP -it's as easy as checking a single box or selecting a different "radio" button in the DHCP management module - but I'm not near my 2K3 server so I can't be certain which of those it is.

The essential difference between the two is that bootp has to have a list of MAC addresses matched to the ip addresses you want assigned to them. You create this list in the same DHCP management module - look for reservations.

[Peter Colsch]

The DHCP solution will not keep someone from configuring a static address and plugging into your switch. The 5300XL series "Access Security Guide" outlines in section 9 "Configuring and Monitoring Port Security" how to accomplish this task.

There is a lot of other good info in there as well.

It can be downloaded from ftp://ftp.hp.com/pub/networking/software/59906052.pdf

Peter

[Ernest Ford]

Quite right Peter - but the request was specifically for a way to filter the "IP requests/offers on a MAC address basis".

Attempts to enforce MAC address restrictions at the switch will limit the use of a switch port to a particular MAC address potentially causing two issues - a given student cannot take his/her notebook from one classroom to the next as well as unused switch ports not being available for use by students that they have not been assigned to.

I have no idea if either of these is a concern in this environment, but it is at my daughter's campus, where access is controlled as I describe.