switch vlan question
in [Cisco]
|
From: Tom on 19 Jan 2010 09:15 I'm looking for a solution that will cause a PC or device with known MAC address or possibly range of MAC addresses to connect to a specific VLAN based on the MAC address. Can that be done with the 2900 series. If so will it required a specific IOS feature set? Thanks in advance.
From: Tom on 19 Jan 2010 10:56 On Jan 19, 9:15 am, Tom <tdenham...(a)gmail.com> wrote: > I'm looking for a solution that will cause a PC or device with known > MAC address or possibly range of MAC addresses to connect to a > specific VLAN based on the MAC address. Can that be done with the > 2900 series. If so will it required a specific IOS feature set? > > Thanks in advance. I looked into this a little more myself... Looks like this can be done via dynamic VLANs. Basically what I'd like to do is set unknown MAC addresses to default to VLAN1 and known MAC addresses go to a preassigned VLAN. This way if an unknown device is plugged into the switch it would not have full access to our network or systems. Is this a simple configuration supported by, for example, a 2960 switch? If anyone has an example of the best way to do this it would be very helpful. Thanks in advance.
From: bod43 on 19 Jan 2010 11:00 On 19 Jan, 14:15, Tom <tdenham...(a)gmail.com> wrote: > I'm looking for a solution that will cause a PC or device with known > MAC address or possibly range of MAC addresses to connect to a > specific VLAN based on the MAC address. Can that be done with the > 2900 series. If so will it required a specific IOS feature set? > > Thanks in advance. Look up VMPS - may now be obsolete. Seems like you can also do this with EAP. Good discussion at - http://www.edugeek.net/forums/networks/10463-mac-based-vlan-allocation-procurve-switches-11x.html
From: Doug McIntyre on 19 Jan 2010 11:01 Tom <tdenham735(a)gmail.com> writes: >I'm looking for a solution that will cause a PC or device with known >MAC address or possibly range of MAC addresses to connect to a >specific VLAN based on the MAC address. Can that be done with the >2900 series. If so will it required a specific IOS feature set? Which 2900 series? Unfortunatly, there's 3 really different cisco devices that is a "2900". I assume its not the 2900 ISR2 router since you say switch in the subject line, although there are switch cards that can go into the 2900 ISR2. Then there's the C2924XL's, and the c2950's catalyst switches.. You know that MAC addresses can be easily spoofed right? If this is a security setup, doing VLAN membership by MAC is going to be as easy to circumvent as the attacker finding out a legit MAC and configuring their system to be it, and then they are on the other VLAN. The secure supported configuration is to use 802.1X and a RADIUS server to assign VLANs based on secure authentication login info. But assuming the lowest common denominator, the c2924xl doesn't support 802.1x authentication, that came along later in the lifespan of cisco. But the c2950 does support 802.1x authentication. If you do really mean to do dynamic VLAN connections just by MAC address, Cisco did have a solution way back in the day called VMPS. You'd have to run up a daemon (OpenVMPS) on a *nix box, or dig up an old 6500/5000 that still had the VMPS server code on it (only a few hardware platforms did). If you do some searches on OpenVMPS you should be able to find it. Just don't expect it to be too secure with the ability of MAC spoofing readily available. Either way, you'll need to be running a server to hand out the info via whichever protocol you choose to use.
From: Tom on 19 Jan 2010 11:17
On Jan 19, 11:01 am, Doug McIntyre <mer...(a)geeks.org> wrote: > Tom <tdenham...(a)gmail.com> writes: > >I'm looking for a solution that will cause a PC or device with known > >MAC address or possibly range of MAC addresses to connect to a > >specific VLAN based on the MAC address. Can that be done with the > >2900 series. If so will it required a specific IOS feature set? > > Which 2900 series? Unfortunatly, there's 3 really different cisco > devices that is a "2900". I assume its not the 2900 ISR2 router since > you say switch in the subject line, although there are switch cards > that can go into the 2900 ISR2. Then there's the C2924XL's, and the > c2950's catalyst switches.. > > You know that MAC addresses can be easily spoofed right? If this is a > security setup, doing VLAN membership by MAC is going to be as easy to > circumvent as the attacker finding out a legit MAC and configuring > their system to be it, and then they are on the other VLAN. > > The secure supported configuration is to use 802.1X and a RADIUS > server to assign VLANs based on secure authentication login info. > > But assuming the lowest common denominator, the c2924xl doesn't > support 802.1x authentication, that came along later in the lifespan > of cisco. But the c2950 does support 802.1x authentication. > > If you do really mean to do dynamic VLAN connections just by MAC > address, Cisco did have a solution way back in the day called VMPS. > > You'd have to run up a daemon (OpenVMPS) on a *nix box, or dig up an > old 6500/5000 that still had the VMPS server code on it (only a few > hardware platforms did). > > If you do some searches on OpenVMPS you should be able to find it. > > Just don't expect it to be too secure with the ability of MAC spoofing > readily available. > > Either way, you'll need to be running a server to hand out the info > via whichever protocol you choose to use. Thanks for the detailed response and pointing out MAC spoofing. We understand this will not be really secure because MAC's can be spoofed, however this is a small setup and we do not really need high security. Just the simple ability to assign a MAC to a VLAN. Can a simple MAC to VLAN mapping be done without VMPS? The switch we normally use is a Cisco 2960 with IOS 12.2(35)SE5. Thanks. |