Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to have a setup in which once i configure a single MAC address for a network jack only that computer may be connected to it. Also, i want to make sure that there is no way a person may get a router's mac address registered and hook up multiple PCs behind the router in a NAT or atleast it should be discoverable.

I know this is somehow possible, as this was done at my university. Anyone knows how?

share|improve this question
1  
What kind of switches do you have? –  Zoredache Nov 25 '09 at 22:56

5 Answers 5

up vote 6 down vote accepted

You'll want to use Cisco Port Security on the access-layer switch. It allows you to set the maximum number of MAC addresses on a certain port, as well as optionally set the specific allowed MAC addresses on that port (Though managing this can get out of hand). Once more MAC addresses are detected, or a different MAC address is swapped in, the port can be configured to shut itself down.

I'm not sure how to stop people from hooking up a NAT-capable router, as in this case, only one MAC address is exposed to the access-layer switch. Port security won't be able to help (Unless you rely on the fact that swapping out a workstation for the router will cause a MAC address change, blocking the port, but this isn't perfect as if the first device to be plugged into the switch is the router, it becomes the allowed MAC address)

More info at http://articles.techrepublic.com.com/5100-10878_11-6123047.html

share|improve this answer
1  
Not to mention that you can "clone" the MAC address of the workstation onto the dinky-toy router. –  womble Nov 26 '09 at 13:58

It cannot be done.

I take a machine with a registered MAC, and replace it with a NAT router that I tell to use the registered machines MAC. Plenty of consumer grade (well under $100) routers can do this be default.

Short of analyzing TCP sequence numbers, it is not possible to know if someone has done this.

But any managed switch should be able to lock ports to MAC addresses (ok, I'm guessing).

share|improve this answer
    
I don't think it is accurate to say it cannot be done. You can make it very difficult, and then combine that with good logging. If you have lots of money you would use 802.1x and/or require software agents on the machine instead of simply allowing based on the hardware address. Your consumer grade router most likely will not support the encryption or software agents necessary to authenticate –  Zoredache Nov 26 '09 at 4:02
4  
You are not paranoid enough. But running all the clients thought a vpn is the way to lock out the untrusted. My point was that you cannot secure your network based on MAC addresses, as those are easily spoofed. –  Ronald Pottol Nov 26 '09 at 4:48
    
If you really want to be paranoid and prevent connecting of untrusted computers, forget playing with MAC addresses. VPN, certificates, encryption, digital signatures, etc. are the way to go. Other solutions are only avoiding it instead doing it right. –  slovon Nov 26 '09 at 10:17
    
What's to stop someone running the VPN or whatever on their dinky-toy router? –  womble Nov 26 '09 at 13:59

You need a switch that is smart enough to configure this limitation. There are plenty of them, but not in the cheapest class.

Update:

There are several switches much under cisco-prices available with port security options. I found HP Procurve 2520 and higher, Dell Powerconnect 5300 and higher and even cheaper, such as Linksys SRW2024, D-Link DES-3252, etc.

Look for "port security", "MAC based".

share|improve this answer
1  
They are, in fact, often ludicrasly expensive –  Mark Henderson Nov 25 '09 at 23:23
    
Those shiny Cisco name-plates are filled with gold, which is at an all-time high price right now. –  Evan Anderson Nov 25 '09 at 23:31
    
tell me about it... just finished picking a 48-port switch for an office... took the little cisco :-) –  slovon Nov 25 '09 at 23:56
    
Cisco paints their stuff green for a reason.. –  GregD Nov 26 '09 at 0:21

Alternatively, you can use a NAC if the users are in an LDAP of some sort. This way users can move from port to port, but people outside of your organization can't get access. I'm not sure if this is the situation that you are trying to prevent, but MAC address spoofing is easy, so your example can be tampered with fairly easily. Cisco Clean Access and Bradford Networks NAC come to mind as the two leaders in NACs, but they are veeery expensive.

share|improve this answer

I might be wrong, but I've heard of ISPs monitoring TTL values to determine if the device directly attached originated the traffic or if it came from devices behind it.

Not perfect, as TTL can be spoofed just like anything else but may be worth checking out.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.