Port-security – Compare max secure MAC address vs current secure MAC address

kristian.gullikstad

Ability to compare “max secure MAC address” vs “current secure MAC address” and make a report that shows these differences.

If you have a switch port which is configured with max allowed 10 MAC addresses but only 8 MAC addresses are currently secured (8 in use). And the port on the switch is configured with sticky. Then you have a security violation.

pony10

This is a great feature request.  I am currently looking at just this situation.  In our recent audit the examiner was able to plug into a couple of ports and gain access to the network even though we are running port security.  The issue we have is that we use a third party tool to "reset/clear" port security issues. 

Example:

Someone moves offices.  They take their computer and IP phone to the new office and plug them in.  This set's off a MAC alert at the new location. We use the tool to set the MAC's to the new port. So far so good.  The problem is that the tool has to clear the MAC's from the previous port. This then leaves that port open for at least 2 devices to be able to plug in without triggering MAC alerts. The tool has no way of setting the previous port to "dummy" addresses or disable. We don't like to disable because that makes it difficult for us to remotely know what port someone has plugged into.

As stated by kristian.gullikstad@statkraft.com this is a security hole that we have no official method of monitoring. We have to manually look at every switch port on a regular basis.

I might even add to the request that it be able to assign "dummy" MAC's to the ports that need them.

I vote up on this.