Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Given a network structure like this:

client 1 \
.         \
.          switch -- firewall
.         / 
client n /

(in words: all clients connected to one switch and the switch connected to the firewall)

Is it possible (on the firewall) to identify the physical port on the switch that a client used?

Background: There's some simple MAC authentification for the clients, there can only be 1 person responsible for what happens an a switch port (because there is just one RJ45 connector per room and 1 person who owns the room). However, it would be possible to fake the MAC address, then I wouldn't know from which room the data is coming, however I need to know this for sure in case of abuses. Is this possible without vlans? Thanks for any hint!

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You can know this by implementing port security on your switch. One requirement is that you have a managed switch. Only one MAC address will be allowed on each switch port.

share|improve this answer
    
Thank you, that's perfect and also supported on the HP switch I am using (up to 8 MAC addresses per port) –  stefan.at.wpf Jun 3 '12 at 14:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.