Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?Is there any way to differentiate MAC address of an Access Point from that of a client?Sticky mac learning PC mac as vlan voice on Cisco 3750v2How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?How do we prevent loss of sensitive information from MAC spoofing?When a datagram moves through a network, do the MAC or IP addresses change?Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?MAC ACL and Network SecurityPossibility of recognising a computer in the network that has changed its mac address?Port Security Or 802.1X Authentication On Non-Server NetworkCisco/Meraki switch SFP compatibility and dual link
"It doesn't matter" or "it won't matter"?
C++ check if statement can be evaluated constexpr
What is the highest possible scrabble score for placing a single tile
Why do Radio Buttons not fill the entire outer circle?
Can you use Vicious Mockery to win an argument or gain favours?
What is the difference between lands and mana?
Delete multiple columns using awk or sed
How to get directions in deep space?
Does the reader need to like the PoV character?
Why does this expression simplify as such?
How would you translate "more" for use as an interface button?
C++ copy constructor called at return
How to draw a matrix with arrows in limited space
What (the heck) is a Super Worm Equinox Moon?
Doesn't the system of the Supreme Court oppose justice?
Make a Bowl of Alphabet Soup
Is there any evidence that Cleopatra and Caesarion considered fleeing to India to escape the Romans?
How to convince somebody that he is fit for something else, but not this job?
What is the English pronunciation of "pain au chocolat"?
What features enable the Su-25 Frogfoot to operate with such a wide variety of fuels?
What are some good ways to treat frozen vegetables such that they behave like fresh vegetables when stir frying them?
awk assign to multiple variables at once
What kind of floor tile is this?
A variation to the phrase "hanging over my shoulders"
Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?
Is there any way to differentiate MAC address of an Access Point from that of a client?Sticky mac learning PC mac as vlan voice on Cisco 3750v2How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?How do we prevent loss of sensitive information from MAC spoofing?When a datagram moves through a network, do the MAC or IP addresses change?Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?MAC ACL and Network SecurityPossibility of recognising a computer in the network that has changed its mac address?Port Security Or 802.1X Authentication On Non-Server NetworkCisco/Meraki switch SFP compatibility and dual link
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
edited 10 hours ago
Ron Maupin♦
67.3k1369126
asked 12 hours ago
techkilljoytechkilljoy
264
add a comment |
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
edited 10 hours ago
Ron Maupin♦
67.3k1369126
asked 12 hours ago
techkilljoytechkilljoy
264
3
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
12 hours ago
add a comment |
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
edited 10 hours ago
Ron Maupin♦
67.3k1369126
asked 12 hours ago
techkilljoytechkilljoy
264
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
mac-address port-security meraki
edited 10 hours ago
Ron Maupin♦
67.3k1369126
asked 12 hours ago
techkilljoytechkilljoy
264
edited 10 hours ago
Ron Maupin♦
67.3k1369126
asked 12 hours ago
techkilljoytechkilljoy
264
edited 10 hours ago
Ron Maupin♦
67.3k1369126
edited 10 hours ago
Ron Maupin♦
67.3k1369126
edited 10 hours ago
Ron Maupin♦
67.3k1369126
67.3k1369126
asked 12 hours ago
techkilljoytechkilljoy
264
asked 12 hours ago
techkilljoytechkilljoy
264
asked 12 hours ago
techkilljoytechkilljoy
264
264
3
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
12 hours ago
add a comment |
3
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
12 hours ago
3
3
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
12 hours ago
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
12 hours ago
add a comment |
1 Answer
1
active
oldest
votes
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered 12 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
11 hours ago
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
11 hours ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "496"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f57844%2fwill-the-sticky-mac-access-policy-prevent-unauthorized-hubs-from-connecting-to-a%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered 12 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
11 hours ago
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
11 hours ago
add a comment |
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered 12 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
11 hours ago
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
11 hours ago
add a comment |
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered 12 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered 12 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
edited 12 hours ago
answered 12 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
answered 12 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
answered 12 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
67.3k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
11 hours ago
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
11 hours ago
add a comment |
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
11 hours ago
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
11 hours ago
5
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
11 hours ago
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
11 hours ago
6
6
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
11 hours ago
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
11 hours ago
add a comment |
Thanks for contributing an answer to Network Engineering Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f57844%2fwill-the-sticky-mac-access-policy-prevent-unauthorized-hubs-from-connecting-to-a%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
3
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
12 hours ago