1. Home
  2. Cisco Systems
  3. port security limitations on 3500s

port security limitations on 3500s

We turned on port security on all of our switches and limited the number of MAC addresses per port. Recently we noticed a problem that occurs with our 3548s where if one port picks up a MAC address (and subsequently stores in its table), that same MAC can't be moved anywhere else. Our 3550s are not affected by this. This can be a pain with users who have laptops and they move from cubicle to cubicle. I tried turning on auto-aging on those switches but it doesn't appear to work. The address is still retained on that port. I had to manually shut down the port where the mac address was last attached to in order for it to connect to another. I don't know if there is a limitation with 3548s or if there is a workaround where we can keep port security on yet the mac address tables should be dynamic (getting rid of addresses it no longer detects OR allows it to traverse from port to port).

Reply to
psychogenic
Loading thread data ...

But the purpose of port security is to ensure that people do -not- move ports without going through proper channels.

Neither of those two would be consistant with the security model offered by port security. All you would have achieved would be the equivilent of setting a maximum number of "recent" MACs per port, and blocking MAC flooding.

It sounds to me as if you what you want is not "port security" but rather something more like EAP / LEAP (802.1x authentication). The 3550s might handle 802.1x, but I would doubt the 3548's would (not even the Cat3584G-L3).

Reply to
Walter Roberson

Hmm, but I thought that is essentially what Port Security also provides (protection against MAC flooding) but I guess that is not its inherent purpose? Guess I'm a little confused, heh. I was reading up on it before implementing it on our switches and thought that it can be either set to sticky (retains the connected MAC address on its table indefinitely?) or that can be disabled so that a mac addresss, if it hasn't sent any packets, would be cleared or be allowed to forward packets through another port?

Reply to
psychogenic

Guess my other question would be, if I go with 802.1x, would it be pointless then to turn on port security?

Thanks again for your help.

Reply to
psychogenic

Quoting context helps: most of the regular posters here do not use googlegroups as their usenet reading interface, so usually cannot immediately see the proceeding messages in the thread.

No, port security is primarily to lock particular devices to particular ports; e.g., to add a measure of trust that it is your finance manager who is accessing the payroll subsystem and not someone who has slipped into that office with a laptop that they have plugged in.

Might depend upon the version; I haven't looked at it recently.

Reply to
Walter Roberson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.