05-16-2008 01:19 PM - edited 02-21-2020 02:01 AM
Hey guys - i have a couple of questions that I hope are quick to answer.
I have a need to provide users with a IP phone at home (extended leave, part timers, etc). The current plan is to provide them an ASA5505 that is configured to create the VPN tunnel over the internet (connects to a ASA5520). We also want to lock down the all the ports execpt e0/0 (outside interface) and e0/7 (the poe enabled phone port). I am tring to configure 5505 so that only the phone will get an ip, AND if they remove the phone, and plug in a desktop/laptop/etc, it wont work (ie - no ip address supplied, ports blocked, etc.). The users will need to use thier existing VPN on thier laptop to get network, we are just trying to supply them a "off site extension" of thier phoens.
So - Question 1 - Can I have the dhcp scope on the asa5505 defined to do a MAC based assignment?
Question 2 - If we cant lock down the scope by mac address, what ports, other than http and skinny (no sip phones here) would/should I block?
If anyone has any other suggstions, im all ears..
Thanks in advance!
05-18-2008 03:30 PM
Place a "shutdown" on interfaces e0/1 to e0/6
For control of devices by MAC access, see "mac-list" command at the following URL:
http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/m.html#wp1888833
05-18-2008 03:34 PM
thanks. Ive already done the shutdown. Ill check the link (if helpfull, ill rate..)
I am looking to ensure that if they take the phone out, they will get nowhere.
thanks.
05-20-2008 09:43 AM
I have read up on the mac-list, and it seems that would work. My question now - how do I apply that to only 1 interface? Seems to me that, since its a global command, it will restrict on all ports, right?
I need e0/0 to be unrestricted, as I have NO idea what the mac address will be of the "dirty" side, but at the same time, e0/7 should be restricted to only the phone that I supply.
Thanks again for the link
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide