Port Security With Sticky MAC addresses
Printed From: CertCities.com Forums
Forum Name: CCIE
Forum Discription: Discuss the CCIE written and lab here.
URL: http://certcities.com/forums/forum_posts.asp?tid=5023
Printed Date: 23 October 2007 at 3:25pm
Topic: Port Security With Sticky MAC addresses
Posted by: hudsonmbg
Subject: Port Security With Sticky MAC addresses
Date Posted: 06 June 2007 at 12:27am
Hi, I have just read that with sticky MAC addresses, the addresses can be learned dynamically and its not necessary to use the switchport port-security mac-address xxxxxx command. Lets say, I have a remote router interface, lets say three hops away and Cisco has not specified the interface type or the Cisco router number/name, and the mac address is 0000.0c12.3456 and apparently, this MAC address has to be manually configured with the mac-address command under the router interface, how do I configure to sticky mac address feature on the switch interface to permit only the above MAC Address? switchport port-security mac-address xxxxxx
-------------
Bishop(TCP/IP), CCNP |
Replies:
Posted by: Headhunter
Date Posted: 06 June 2007 at 12:30am
Mmmm never read the way TCP/IP works...
Layer 2 address changes hop by hop, Layer 3 remain the same
so how can you assign a MAC from 3 hops away???
-------------
Koen
CCSI#30501 CCNP CCIP CCVP CCSP CCDP CQS-Cisco Wireless LAN Design & Support Cisco Unity Design Specialist Cisco IP Telephony Design Specialist JNCIA-ER MCSE MCSA:Messaging |
Posted by: hudsonmbg
Date Posted: 06 June 2007 at 12:46am
I don't think you understood my question. U specify the MAC address on a remote interface using the mac-address command. I guess you realize that every interface be it on a router or switch has a MAC address or could have a MAC address manually assigned to it.
-------------
Bishop(TCP/IP), CCNP |
Posted by: hudsonmbg
Date Posted: 06 June 2007 at 12:49am
Ok let me state it this way. Lets say that MAC address is on one of the interfaces in the local segment and you want to dynamically allow just that MAC address to access a port configured with port security without using the switcport port-security mac-address command. My questions is how do you specify just that MAC address and ignore others.
-------------
Bishop(TCP/IP), CCNP |
Posted by: Headhunter
Date Posted: 06 June 2007 at 12:54am
hudsonmbg wrote:
| Lets say, I have a remote router interface, lets say three hops away and Cisco has not specified the interface type or the Cisco router number/name, and the mac address is 0000.0c12.3456 and apparently, this MAC address has to be manually configured with the mac-address command under the router interface, how do I configure to sticky mac address feature on the switch interface to permit only the above MAC Address? |
|
|
Not understand your question.... read it again yourself
-------------
Koen
CCSI#30501 CCNP CCIP CCVP CCSP CCDP CQS-Cisco Wireless LAN Design & Support Cisco Unity Design Specialist Cisco IP Telephony Design Specialist JNCIA-ER MCSE MCSA:Messaging
|
Posted by: Headhunter
Date Posted: 06 June 2007 at 12:54am
hudsonmbg wrote:
| Ok let me state it this way. Lets say that MAC address is on one of the interfaces in the local segment and you want to dynamically allow just that MAC address to access a port configured with port security without using the switcport port-security mac-address command. My questions is how do you specify just that MAC address and ignore others. |
|
|
And now it's local segment....
you don't even know yourself what exactly you are asking
-------------
Koen
CCSI#30501 CCNP CCIP CCVP CCSP CCDP CQS-Cisco Wireless LAN Design & Support Cisco Unity Design Specialist Cisco IP Telephony Design Specialist JNCIA-ER MCSE MCSA:Messaging
|
Posted by: Headhunter
Date Posted: 06 June 2007 at 12:59am
switchport port-security maximum value
switchport port-security mac-address sticky
value = 1 then first dynamically learned address will be the secure MAC address
-------------
Koen
CCSI#30501 CCNP CCIP CCVP CCSP CCDP CQS-Cisco Wireless LAN Design & Support Cisco Unity Design Specialist Cisco IP Telephony Design Specialist JNCIA-ER MCSE MCSA:Messaging |
Posted by: hudsonmbg
Date Posted: 06 June 2007 at 3:03am
Thanks for that. But what if it learns of another MAC Address before the specific MAC address I want allowed on that interface? I know I am not putting things straight but I hope you get a feel of what I am trying to know. The way I understand dynamic is like first come first serve.
-------------
Bishop(TCP/IP), CCNP |
Posted by: Headhunter
Date Posted: 06 June 2007 at 3:07am
that is right first MAC viewed on the port is the secure, is most secure setup but unhandy... NIC failure, forget about port security and joy joy
you can change the value or make sure the right device is plugged in correctly
-------------
Koen
CCSI#30501 CCNP CCIP CCVP CCSP CCDP CQS-Cisco Wireless LAN Design & Support Cisco Unity Design Specialist Cisco IP Telephony Design Specialist JNCIA-ER MCSE MCSA:Messaging |
|