Hi,

Thanks for the reply, but if you can clarify below

, I want at HQ (3560)site that only data comes from data centre(3750) sw,

Does it not better idea to enable port security at HQ sw to only allow one mac-address, which is the mac of datacentre sw?

Regards,

Hi,

Just a warning, as your link is a layer 2 link, all the MAC addresses of the devices sending frames through the link will arrive at the HQ switch. You can have a look at the MAC addresses with "show show mac address-table interface XYZ". One MAC address will for sure not be enough, instead there likely will be many of them.

Regards, Martin

Actually switch in datacentre is only a connection point between HQ and remote site sw(3750) ,whrere all the services are.Only concern we have that at datacentre(not managed by us) site some one can plug a device and have access to our LAN at either side HQ or Remote.

Regards,

I don't think that port-security was designed or meant to work that way - limitting mac-add from switch to switch.

In my understanding, port-security was designed for you to lockdown your switchports against unauthorized connections to your switch, along with few other features. For example, if your switchport 3750 fa0/1 mac-address is set to 2 with Sticky option enabled, the third device connected to this switchport would not establish a network connection at all.

Take a look at this link to understand more about port-security.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_35_se/configuration/guide/swtrafc.html#wp1042596

hieu

Thanks,

So what will be the best solution in this senario?

Regards,

Since the switch in the data center is connected to your HQ switch, but it's not managed by you, then your simplest solution is to ask the administrator managing that switch to configure port-security with the settings that you'd like to implement to keep your network as secured as possible.

hieu

ok,but what will happen if some take the connection physically of from datacentre sw, plug a diffrent hub/sw/pc , then will have access to our network.

Thats why we like to implement security on our side sw at hq,

we can make this a layer 3 connection.

regards,

If you have port-security configured properly in the switch in the datacenter, then another ip device connected to the same switchport would not have access to your network because the port is either restricted or shutdown.

Example:

switchport port-security maximum 2

switchport port-security

switchport port-security aging time 1

switchport port-security violation restrict

switchport port-security aging type inactivity

switchport port-security mac-address sticky

switchport port-security mac-address sticky xxxx.xxx.xxxx.xxx vlan voice

switchport port-security mac-address sticky xxxx.xxxx.xxxx

spanning-tree bpduguard enable

The third device connected to the same switchport would fail network connection.

When you enable the Sticky option, it'll learn the mac-add dynamically and add them to the switchport. You just need to save the config at this point so that if you reboot the switch, it doesn't have to relearn the mac-add. Of course, the downside of this is that if your device mac-add is changed at the other end, then you need to update your switch with the new mac-add for that port manually. Also, don't forget to shutdown all unused switchports too.

In your HQ switch, maybe you can implement ACL to accept traffic from the datacenter, but if someone has physical access to your switch and replaces it with something else entirely without your knowledge or consent and with the intent to cause harm, then it becomes a much bigger issue. Someone at the datacenter managing that switch must be responsible for the physical security to that switch.

I don't know of an "easy" way to address your concern, so I hope others in this forum can help you out as I am interested in a viable solution as well.

hieu