Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Outside switch restriction

Dear All,

I would like to restrict outside Switches connecting to our network. its noticed that employees brings 8 port switches to work place and connecting to their lan port. from their they are extending to personal laptopes e.t.c

Heard that connecting High revision switches into network will washout entire vlan configuration of existing network.

How to restrict outside switches connecting to our network?

Thanks

  • LAN Switching and Routing
4 REPLIES

Re: Outside switch restriction

If your edge switches are Cisco, you can use bpduguard with portfast enabled on the ports that you want to protect. When the switch senses a bpdu on that port, the port will shut in an err-disabled state. You can have the port automatically reenable after it stops hearing bpdus by using:

"errdisable recovery cause bpduguard"

"errdisable recovery interval "

HTH,

John

HTH, John *** Please rate all useful posts ***
Cisco Employee

Re: Outside switch restriction

You can use few IOS features for the same. Like Port-security with maximum count 1, BPDU guard to disable the port, BPDU filter, root guard etc...

Please go through some of the features here :

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_40_se/configuration/guide/scg.html

HTH

Hall of Fame Super Bronze

Re: Outside switch restriction

The configuration of bpduguard on access-ports may alleviate the problem if the switches send bpdus.

As we know, most SOHO switches do not use bpdus so you are left with implementing port-security on the access-ports.

As to how many MAC-Addresses are allowed on each of the switchports, the answer is; it depends. If you have VoIP, then you need 2 MACs in the access-vlan and 1 MAC in the voice-vlan. If you don't have VoIP, then you can configure each switchport for 1 MAC.

HTH,

__

Edison.

Super Bronze

Re: Outside switch restriction

"Heard that connecting High revision switches into network will washout entire vlan configuration of existing network. "

That's possible if it's a Cisco switch with VTP. There are VTP options to minimize or negate this risk, especially in the later VTP features.

"How to restrict outside switches connecting to our network? "

Difficult to do unless you're using some of the latest Cisco switches and access port authentication. Not positive, but I recall some switches might support a simple method to limit number of MACs allowed active on an access port. However, NAT type devices can hide number of devices behind single MAC.

231
Views
9
Helpful
4
Replies
This widget could not be displayed.