Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can we restrict any user's PC connecting to the network based on their MAC Address?

share|improve this question

It's generally called MAC address filtering, and can be accomplished generally through a network access control product (sometimes called Network Access Protection, because that's what Microsoft named their NAC product) residing on a server, or by configuring your networking gear with MAC address whitelists and/or blacklists.

Specific implementations vary, so if you need a more detailed answer, you'll probably need to provide information about your environment, or live in the vain hope that someone's going to come along and post a quick how-to on all the major vendors NAC implementations.

share|improve this answer
We have users' PC connecting to Cisco Switches directly, and we are planning to use Port Security feature to filter based on MAC Address. Can we go ahead with this Plan? or doing it with NAP on Windows Server would be a better way? – Petchirajan Shanmugaraj Jan 2 '13 at 8:36
mac address security is weak as users can unplug a desktop from a port, spoof its mac and connect to the network. It is also an administrative nightmare when machines get moved and replaced. NAC/ACS with certificate-based authentication is the way to go. – Paul Ackerman Jan 2 '13 at 12:54
@PetchirajanShanmugaraj Strictly speaking, the port security feature only limits every port to one MAC address (so you can't plug a little workgroup hub/switch into a port and get more than one device per port), so it's not going to achieve what you want in and of itself - but could be part of your solution. Personally, I hate that feature and turn it off whenever I can, because more often than not, all it does is get in the way when someone decides they need a printer in their office. I would either not bother with NAC/MAC address filtering, or do as Paul suggests in the comment above this. – HopelessN00b Jan 2 '13 at 16:17
@Paul Ackerman & HopelessN00b : Thanks a lot for your inputs! – Petchirajan Shanmugaraj Jan 2 '13 at 17:39

you can follow these links to configure your need:

Do let me know if it helped you ?

share|improve this answer
-1 for now. Link-only answers are strongly discouraged. Please provide content here, otherwise your answer loses all of its value when that link goes dead. – EEAA Jan 2 '13 at 6:47
Jyotiprakash, Thanks.But it was specific to D-Link if i am not wrong and i have some ideas now in Cisco Environment, we can do it with switchport port-Security feature. – Petchirajan Shanmugaraj Jan 2 '13 at 6:49
Additionally, the "solution" you linked to has nothing to do with access controls that would be put in place on a professional network. Home network routers and professional managed switch gear are two vastly different things. – EEAA Jan 2 '13 at 6:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.