Network port security

[Ev0]

The guys who look after the network at our place (3rd party supplier) implemented a MAC address lockdown on our ports only allowing to MAC addresses to work on each port.

However this is causing us grief (we look after everything else bar the network) with moving stuff around, hot desks with laptops etc.

Now we'd like to maybe junk this method and use something else, but what?

I vaguely remember doing something with 802.1x and certificate based port security at my last place, but that was ages ago and I'm no networks expert.

In the case above using certificates, how would you get a new machine without the cert onto the network?

We're using all Cisco kit but can't remember the exact switch details bar the 6500 something or other (think they are all POE as well).

Posted in Enterprise chat but if people think it's more suited to the networks forum then please stick this there

 

[garyh]

Without knowing what exactly you are trying to achieve with this setup I can only advise the following links

http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_8021x.html

http://itdump.wordpress.com/2007/11...ication-on-cisco-switch-with-samba-in-debian/

If you simply want to restrict the network to 'known' clients - there are various ways to do this, the links above are just one method of implementation. I'm too tired to post anymore, I'll advise tomorrow

 

[Ev0]

Cheers. yup it's to stop 'unauthorised' devices connecting up to the network.

 

[sidethink]

This is generally known as NAC or NAP (if you work at MS)

Network Admission Control.

We've done a few different systems and they are all a bloody nightmare - unless you work somewhere that is at particular risk of foreign machines or you have something super-secret to protect; I'd park it.

The number of calls to your helpdesk will increase sgnificantly if you implement NAC. You must be willing to bear that burden for the little bit of extra security.

 

[Ev0]

This is generally known as NAC or NAP (if you work at MS)

Network Admission Control.

We've done a few different systems and they are all a bloody nightmare - unless you work somewhere that is at particular risk of foreign machines or you have something super-secret to protect; I'd park it.

The number of calls to your helpdesk will increase sgnificantly if you implement NAC. You must be willing to bear that burden for the little bit of extra security.

Cheers, well it's kind of in place at the moment in a rondabout way with the mac restrictions. As for if we should have it or not, as we're government it depends what we're told we need to do

 

[Curiosityx]

From a Cisco point of view NAC requires careful planning and can be costly depending on the size of the deployment, although when in place is incredibly effective.

A cheaper solution would be to use 802.1x in combination with Microsoft Certificate Services should you have a Windows Server capable to do so. Much of the work can be accoumplished centrally through active directory and IAS.

Can i ask what switches your using?