Network port security

[Ev0]

The guys who look after the network at our place (3rd party supplier) implemented a MAC address lockdown on our ports only allowing to MAC addresses to work on each port.

However this is causing us grief (we look after everything else bar the network) with moving stuff around, hot desks with laptops etc.

Now we'd like to maybe junk this method and use something else, but what?

I vaguely remember doing something with 802.1x and certificate based port security at my last place, but that was ages ago and I'm no networks expert.

In the case above using certificates, how would you get a new machine without the cert onto the network?

We're using all Cisco kit but can't remember the exact switch details bar the 6500 something or other (think they are all POE as well).

Posted in Enterprise chat but if people think it's more suited to the networks forum then please stick this there

 

[Ev0]

Cheers. yup it's to stop 'unauthorised' devices connecting up to the network.

 

[Ev0]

This is generally known as NAC or NAP (if you work at MS)

Network Admission Control.

We've done a few different systems and they are all a bloody nightmare - unless you work somewhere that is at particular risk of foreign machines or you have something super-secret to protect; I'd park it.

The number of calls to your helpdesk will increase sgnificantly if you implement NAC. You must be willing to bear that burden for the little bit of extra security.

Cheers, well it's kind of in place at the moment in a rondabout way with the mac restrictions. As for if we should have it or not, as we're government it depends what we're told we need to do