How important in real scenario is port security? I have some managed switch and I read in manual that there is an option to limit access to port to certain MAC addresses (you can do this manually, or by learning option). When and why would I use this option? If there is no way to join this network outside the building, would this option remain unused? And If I allow some MAC-A address to access this port, is this the source PC MAC address, or it must contain all the MACs that are in between this switch and a PC? like MAC of some other switch which interconnects these two devices?
Thanks in advance,
Goran
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Thanks for the response. If I have next layout
PC1 --------------------------
PC2 --------------- some small switch ------------------- managed switch
PC3 --------------------------
As you can see, 3 PCs through one small switch are connected to one port on main switch. Do I need to enter all 3PCs MAC addresses and MAC address of the intermediate switch to allowed list, or just 3 MAC addresses from PCs?
For networks using port authentication (802.1x), you would also want to use port security for devices which aren't capable of authenticating with the network (printers, scanners, etc.). Port security is generally considered a relatively poor form of security, as MAC addresses are easily spoofed. However, it is better than nothing. If your computers will be moving ports a lot, you'll have to reconfigure the port every time one moves (another reason why many networks use 802.1x instead).
@guardsman85
After reading about Port authentication (802.1x), I am not sure if we are talking about same thing here? I am not tusing port authentication hereis, at least not in the form of authentication server, this is a sepratae option on a switch. I am not sure about maximimum supported MAC addresses per port, but here is an option called Maximum entries (per port), and it can be set to more than one, so I am guessing that its possible to add more MACs than one. And manual is talking in plural, too.
So, if id it supports more MAC addresses per port, should I always use this option, or not? What is the general rule for administrators?
Business Accounts
Answer for Membership
by: mutahirPosted on 2009-11-03 at 19:17:50ID: 25736104
Switch port security is a good feature if you have tight security policies or are a LAN with critical data
it has to be the client's (PC) network card's mac address, it can be useful as it will not let anyone just plug in their home laptop and get on the network access file resources etc
if you have critical data, financial, it is a good feature to enable as that will make sure only the computers / devices allowed can be plugged in via the network sockets on your business floor ; even if someone gets access to your comms room they won't be able to plug in and get access to the local (Lan).
You can do it by the learning option if your switch has the feature or manually
For manually, you can go into your dhcp server and check for ip addresses and their coresponding mac addresses
http://kl2217.wor