HOW TO BLOCK A MAC ADDRESS TO THE INTERNET ON A PRIVATE NETWORK.
I'm looking at the same issue for a client. Security and disclosure issues.
Trust me, a difficult model to manage, especially in a large node network. Hardware swaps etc.
I may be schooled by others who have a bit more experience with CISCO. I wont cry.
Not a one man job unless about 25 nodes or less.
A:) I would set up a MAC Address translation table to a range of Specific Range of IP addressees. On the higher range.
B:) For hacking purposes, I would be a little worried about a spoofed MAC address so I would enforce a legit MAC address to access my network and have most setup with static IP's to be able to trace activity on my network. Who did what. To create a random spoofed MAC address that works in this model is really hard.
C:) If authenticating on a Windows Server I would impose Domain Group Policy. That will be a real user based control model.
That is the router.
Then you have the firewall. Same concept but you can open and close access to outside IP's and lock down the network further. ie. Access to a corporate Cloud server only, no if's and or buts.
Then, once again, you have issues of sharing user ID's and passwords. But your fall back would be on the MAC address.
And, a big plus is IP logging to see who did what via reporting.
On Facebook all day? Or worse...... Chat sites Vid. Etc.
Almost fail safe.
Just 30 yrs of network experience.
Novell server, Windows networking, Linux, Windows Server, Unix, Token Ring, 10 Base-T Coax, 10 Base CAT-5, 100 base, 1Gb, Fiber.
I'm also a Tier III help desk support specialist. Custom servers, RAID-5, Raid-10, off site backup, redundant off site servers. Disaster recovery.
You name it been there done it. ect, etc.
Take it or leave it.
Just my 2 cents.
I do contract work and consultation.
423-755-1358
