Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to define in my Cisco switch a whitelist of allowed MAC, but MAC spoofing could allow any host to connect. How can I prevent MAC spoofing?

share|improve this question

migrated from unix.stackexchange.com Oct 22 '13 at 14:46

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems..

5  
You cannot..... –  Marco Oct 22 '13 at 11:41
    
What marco said. Many embedded systems don't even have a MAC address at all. They have to spoof. –  Patrick Oct 22 '13 at 14:00
    
Best you can hope for is having the switch lock down port/MAC pairs when it sees them for the first time, but that's a terrible idea for a lot of reasons. –  Shadur Oct 22 '13 at 14:33

3 Answers 3

You don't prevent MAC spoofing, since it's entirely client-side. This is the reason that no one that really cares about security is using MAC whitelisting or blacklisting.

If you care about controlling what devices connect to your network, you should be using 802.1x with device certificates issued by your own internal CA that you control, or with some form on NAC like Cisco ISE or Microsoft NAP.

share|improve this answer
    
Indeed. security by futzing with MAC addresses is at best a minor inconvenience to anyone with even slight competence, and these days only a slight speedbump to newbie hackers who have heard of Google before. –  RobM Oct 22 '13 at 14:57

You cannot prevent MAC spoofing. The problem you're trying to solve is authentication. And the MAC address is simply not the right way to provide authentication since it can be spoofed very easily. There are even legit reasons to spoof a MAC address.

If you want to restrict which computers can connect, you have to use better methods than relying on the MAC address, preferably methods that levereage some sort of encryption.

share|improve this answer

Can't you somehow prevent it via switchport port-security?

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/20ewa/configuration/guide/port_sec.html

You're not going to prevent an host to spoof its mac, but its spoofed traffic won't pass the access port.


share|improve this answer
1  
You misunderstand - port-security limits the MAC address(es) that can talk over a port, but it has no way of knowing whether a device has spoofed that address or not. –  Dan Oct 22 '13 at 15:49
    
You're right. But if MAC is spoofed, is not the one registered on that port and then it's traffic is "locked". –  user1293137 Oct 22 '13 at 19:10
    
So? We know that and the OP knows that - but port security does nothing to prevent MAC spoofing and, indeed, can be trivially bypassed using it. –  Dan Oct 22 '13 at 21:12
    
Mmh...now i got it! Sorry i really misunderstood at the beginning. –  user1293137 Oct 23 '13 at 14:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.