Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?Is there any way to differentiate MAC address of an Access Point from that of a client?Sticky mac learning PC mac as vlan voice on Cisco 3750v2How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?How do we prevent loss of sensitive information from MAC spoofing?When a datagram moves through a network, do the MAC or IP addresses change?Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?MAC ACL and Network SecurityPossibility of recognising a computer in the network that has changed its mac address?Port Security Or 802.1X Authentication On Non-Server NetworkCisco/Meraki switch SFP compatibility and dual link
Why do Radio Buttons not fill the entire outer circle?
Why do ¬, ∀ and ∃ have the same precedence?
Do we have to expect a queue for the shuttle from Watford Junction to Harry Potter Studio?
What is the English pronunciation of "pain au chocolat"?
Creating two special characters
Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?
Biological Blimps: Propulsion
Is it ethical to recieve stipend after publishing enough papers?
Has the laser at Magurele, Romania reached a tenth of the Sun's power?
How do I fix the group tension caused by my character stealing and possibly killing without provocation?
How can ping know if my host is down
The IT department bottlenecks progress, how should I handle this?
How to draw a matrix with arrows in limited space
When were female captains banned from Starfleet?
Make a Bowl of Alphabet Soup
How does electrical safety system work on ISS?
Is a Java collection guaranteed to be in a valid, usable state after a ConcurrentModificationException?
Are Captain Marvel's powers affected by Thanos breaking the Tesseract and claiming the stone?
How to get directions in deep space?
Why is so much work done on numerical verification of the Riemann Hypothesis?
"before" and "want" for the same systemd service?
What does Apple's new App Store requirement mean
How could a planet have erratic days?
I found an audio circuit and I built it just fine, but I find it a bit too quiet. How do I amplify the output so that it is a bit louder?
Will the Sticky MAC access policy prevent unauthorized hubs from connecting to a network?
Is there any way to differentiate MAC address of an Access Point from that of a client?Sticky mac learning PC mac as vlan voice on Cisco 3750v2How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?How do we prevent loss of sensitive information from MAC spoofing?When a datagram moves through a network, do the MAC or IP addresses change?Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?MAC ACL and Network SecurityPossibility of recognising a computer in the network that has changed its mac address?Port Security Or 802.1X Authentication On Non-Server NetworkCisco/Meraki switch SFP compatibility and dual link
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
edited 5 hours ago
Ron Maupin♦
67.3k1369126
asked 7 hours ago
techkilljoytechkilljoy
264
add a comment |
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
edited 5 hours ago
Ron Maupin♦
67.3k1369126
asked 7 hours ago
techkilljoytechkilljoy
264
3
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
7 hours ago
add a comment |
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
edited 5 hours ago
Ron Maupin♦
67.3k1369126
asked 7 hours ago
techkilljoytechkilljoy
264
We have Meraki MS 250 switches. I have discovered some personal hubs attached to the network and want to ensure these devices wont work on the network to discourage the behavior.
From what I can see, my best option to implement port security with Meraki switches is configuring all access ports for sticky MAC with a list size of 1.
Meraki switch port settings
Is this correct or have I missed something?
mac-address port-security meraki
mac-address port-security meraki
edited 5 hours ago
Ron Maupin♦
67.3k1369126
asked 7 hours ago
techkilljoytechkilljoy
264
edited 5 hours ago
Ron Maupin♦
67.3k1369126
asked 7 hours ago
techkilljoytechkilljoy
264
edited 5 hours ago
Ron Maupin♦
67.3k1369126
edited 5 hours ago
Ron Maupin♦
67.3k1369126
edited 5 hours ago
Ron Maupin♦
67.3k1369126
67.3k1369126
asked 7 hours ago
techkilljoytechkilljoy
264
asked 7 hours ago
techkilljoytechkilljoy
264
asked 7 hours ago
techkilljoytechkilljoy
264
264
3
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
7 hours ago
add a comment |
3
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
7 hours ago
3
3
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
7 hours ago
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
7 hours ago
add a comment |
1 Answer
1
active
oldest
votes
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered 7 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
7 hours ago
5
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
6 hours ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "496"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f57844%2fwill-the-sticky-mac-access-policy-prevent-unauthorized-hubs-from-connecting-to-a%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered 7 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
7 hours ago
5
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
6 hours ago
add a comment |
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered 7 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
7 hours ago
5
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
6 hours ago
add a comment |
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered 7 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
As Jesse P explained, hubs do not have MAC addresses, but multiple devices connected to a hub would mean multiple MAC addresses on the switch interface, and what you suggest would detect that and prevent a situation where a hub is attaching multiple devices to a single switch interface. Unfortunately, it will be unable to detect the hub or a hub with a single device connected.
You must carefully consider your plan. For example, using a VoIP phone with a PC plugged into it could use two or three MAC addresses on the single switch interface. I have seen that mess up plans such as yours because you must allow more than one MAC address at a time for things to work correctly.
If what people are doing is to connect small switches, rather than hubs, then those switches would have MAC addresses, and may even be sending BPDUs. You could then configure something like bpduguard that will disable the switch interface when it receives BPDUs. That is a very common, and recommended, practice for access interfaces on a switch.
answered 7 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
edited 7 hours ago
answered 7 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
answered 7 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
answered 7 hours ago
Ron Maupin♦Ron Maupin
67.3k1369126
67.3k1369126
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
7 hours ago
5
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
6 hours ago
add a comment |
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
7 hours ago
5
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
6 hours ago
5
5
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
7 hours ago
Managed switches have a MAC (because you need to talk to them). Unmanaged switches don't.
– Ricky Beam
7 hours ago
5
5
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
6 hours ago
Some unmanaged switches have MAC addresses if they use STP. We have people plug in the small 5-port switches that end up shutting down the company switch interfaces because they send out BPDUs.
– Ron Maupin♦
6 hours ago
add a comment |
Thanks for contributing an answer to Network Engineering Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f57844%2fwill-the-sticky-mac-access-policy-prevent-unauthorized-hubs-from-connecting-to-a%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
3
Hubs don't have MAC addresses. They have no concept of MAC addresses because they don't need to track which device is plugged into which port. Switches, on the other hand, do.
– Jesse P.
7 hours ago