MAC Address Allow List 2

[CADstillo]

Hello:

I need to create a MAC address list for a company I contract for on their Cisco Catalyst 2950 switches.

I have never done this before. Can anyone give me some assitance.

I have very limited CISCO interface knowledge. I know how to connect to the switch and run a few commands other than that I am totally new to CISCO switches.

Thanks

 

[KiscoKid]

Hi

Can you clarify something for me but is your question:

How do I get a list of all MAC addresses on the network?

or

How do I secure a switch to accept only certain MAC addresses to connect to it?

 

[CADstillo]

Thanks KiscoKid, actually both.

I know that all of the existing devices on the network are owned by the company:

1)If I can get information on how to retrieve a list of all MAC Addresses on the network.

and then

2)With that MAC Address list, how can I secure the switches to accept only those MAC addresses (one per port) so no foreign MAC address can connect to the network?

Thanks!

 

[KiscoKid]

Hmm regarding your first point (retrieving list of mac addresses), I'd probably look to do this by combining two methods:

1. Run a tool called Angry IP Scanner. With this you can scan all your internal IP networks and ask Angry Scanner to report all IP's and corresponding MAC addresses.

You can Angry IP Scanner here:

http://www.angryziber.com/ipscan/

You can also use useful commands like 'show mac-address' on each of your LAN switches to see which MAC address is currently connected to which port.

2. To actually secure a particular MAC address to a switchport, all you need to do is the following:

Switch(config)#interface fa0/0
Switch(config-if)#switchport mode access
Switch(config-if)#switchport port-security
Switch(config-if)#switchport port-security violation [restrict | shutdown]
Switch(config-if)# switchport port-security mac-address [mac_address]

You can verify your changes with the 'show port-security address' command

3. Unfortunately the correct application of MAC address to switchport will either mean: YOu have up-to-date records that clearly document which IP/MAC addresses are already present on the network, who is using them and where they physically connect into the network.

If you don't have this kind of documentation, I'd advise creating that document as part of this exercise. This may involve visits to each device on each port and matching the MAC address seen on the port to the owner of that MAC address.

Hope this helps

 

[CADstillo]

I will try this out after hours, yes I will make a MAC address database.

 

[kcbell]

KiscoKid:

I have not done port security with the 2950. I think you can program it to receive the first MAC connect to it is the only MAC allow. If a second MAC is connected to the port then it will create a shutdown of the port and generate a violation to your SNMP syslog or whatever you use to monitor the network. There is no need to enter the MAC on each port.