How to Limit Connections to Computers with Specified MAC addresses

[lssprowls]

By default the SG300-52P switch (300 Series Managed Switch) creates a Dynamic Address for any computer attached to it. I would like the switch to accept connections only from devices whose MAC address are "registered" in the device. I see that it is possible to create "Reserved MAC Addresses" and also to create "MAC-Based VLAN Groups". Should I use one of these features? How do I prevent the switch from creating dynamic addresses.

I read that it is possible to assign MAC addresses to ports. I'd prefer to allow computers with a valid MAC addresses to attach to any port. That way, I don't have to reconfigure the switch if a user connects his computer to a different port.

[Tom Watts]

Hi Lawrence, try this

https://supportforums.cisco.com/docs/DOC-27720

https://supportforums.cisco.com/docs/DOC-27753

Please let me know if this is not what you want. In the case this is not satisfactory, you need to look in to DYNAMIC ARP INSPECTION but that maps IP to MAC but can be regardless of port.

-Tom
Please mark answered for helpful posts

[lssprowls]

I would prefer to allow a computer with a valid MAC address to be able to connect to any port, not just a specific port. Otherwise, for example, an employee cannot simply move his laptop from the port at his desk to a port in a conference room.

[mpyhala]

Lawrence,

You may find this helpful as well:

http://sbkb.cisco.com/CiscoSB/Loginr.aspx?login=1&pid=2&app=search&vw=1&articleid=1863

- Marty

[lssprowls]

Suppose I configure VLAN1 for a set of MAC addresses. Nothing would prevent the switch from accepting additional, dynamic connections to VLAN1, right? So in order to make this work, I'd have to create, say, VLAN2 with my valid MAC addresses and have the switch accept dynamic connections into VLAN1 which would be configured as a "dummy" VLAN with no connections to servers and the firewall, right?