Locking down Cisco switch ports.

Hello, I have a cisco 2960 swith that I need to limit access to.  How can I only allow access from a single MAC address?
If I have a cisco phone attached to a catalyst port, how do I limit the port that is physically on the phone?

mrbodjaglesAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

bec0sCommented:
If I understand correctly, you need to enable port security on your switch.

For reference
http://www.techrepublic.com/article/lock-down-cisco-switch-port-security/6123047
http://www.cisco.com/en/US/docs/switches/lan/catalyst2970/software/release/12.1_14_ea1/configuration/guide/swtrafc.html#wp1090391


The minimum commands you should use under the interface are:
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address sticky

This will enable the switch to lock the port to the first MAC address that will "hear" on the port and permit traffic only from it untill it is rebooted.

The default action if a second MAC comes in is to shutdown the port.  You can override this by using the command:
switchport port-security violation [restrict | shutdown | protect]

0
mrbodjaglesAuthor Commented:
How do I lock down to just a specific IP address?
How do I lock down a port with a Cisco IP phone attached, since the Cisco IP phone also has a switch port.
 
0
lrmooreCommented:
You can disable the phone's switchport in Callmanager.
Otherwise, what bec0s posted above is exactly what you need. You can't do it by IP address, but you can specify the mac-address or let the switch learn it with the sticky command above. The switch learns the first mac, and "sticks" it to that port. You can't move that device to another port on the switch.
Limiting the security to 1 single mac address with the maximum 1 command effectively does the same thing.
0
Cloud Class® Course: Amazon Web Services - Basic

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

mrbodjaglesAuthor Commented:
I understand what you are saying, but I have a cisco IP phone attached to the switch port.  How do I enable only one MAC address on the phone switchport?
0
lrmooreCommented:
You can't do that specifically on the phone, but you can specify max 2 mac-addresses allowed on the switchport. This will lock down to the phone itself plus the first one device connected to the phone.
0
mrbodjaglesAuthor Commented:
What are the commands to specify only 2 mac addresses?
0
Marius GunnerudSenior Systems EngineerCommented:


int fa0/0
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address xxxx.xxxx.xxxx
switchport port-security violation shutdown

You can use the sticky command as mentioned above but entering the MAC manually will give you more control over the MAC that connects to that port. As long as you don't have to enter a large amount of MACs, I would suggest static configuration.
0
Marius GunnerudSenior Systems EngineerCommented:
Forgot to mention shutdown of the port if there is a violation is the default action
0
mrbodjaglesAuthor Commented:
Did not work:

Command rejected: GigabitEthernet1/0/46 is a dynamic port.

Anyone else with more knowledge want to take a crack at this?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mrbodjaglesAuthor Commented:
None of the experts responses solved the issue.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Switches / Hubs

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.