Printable View
I have got Cisco switch 2950 , I have got a PC plugged to port 14.
Can I configure the switch to prohibit the PC if it has been unplugged from the port 14 and plugged again to the same port ?
The reason for that if a user unplugged a PC from intranet (internal network) and connected it to an internet port (another switch), and then he/she wants to plug it back to same port on the intranet (internal network) he/she will be denied.
Hi,
I am finding it a bit difficult to visualise your setup, and what activity you are actually trying to control.
Also, how come that users have physical access to the switch? Even if you have to keep it in an open office environment, have you considered enclosing it in a locked steel box?
:confused:
They do not have physical access to the switch, but they do have physical access to wall jack sockets, that connect to the switch portsQuote:
Also, how come that users have physical access to the switch? Even if you have to keep it in an open office environment, have you considered enclosing it in a locked steel box?
Ah! I see, so you have two separate sockets.
I don't know your hardware so I don't know if it is possible, I guess I would run them all through a server and use permissions to control internet access.
Can you physically disable the internet sockets, or are you just concerned that some one connects to the net, infects their machine then plugs into the lan? Hard wiring would be a possible simple solution.
Are the users supposed to be able to access the internet at all?
If this were possible it wuld be entirely impractical. What's the difference between the user unplugging the network cable and them turning off their computer? Zero, as far as the switch is concerned. So whenever the user turns their computer on your system would DoS them... Actually, I'm beginning to like the idea... ;)
I can't think of a feasible way of doing this except perhaps a script that pings your gateway router, (outside the firewall), every 30 seconds or so. If it finds the gateway router then it should disable the NIC. That way you minimize the window of infection _and_ you will get a call from the user when the intranet isn't accessible to them... Which is ammunition in their dismissal... :D
Hi Tiger~ thank God you have joined in. As you know this is not my area other than building it into projects and getting the description and costs into the proposals. Perhaps I should pay more attention to the techies, but when your objective is to keep the project meetings down to a reasonable duration, and keep the hours charged to your budget to a minimum................... :(
I really think we need a bit more information on the actual system requirements and the perceived issues here?
If it is a straight security thing, then I would have thought that you need two networks. A general network and a secure network. The users would have two workstations with two unique IDs, the general network machine could not connect to the secure network, and vice versa, and the secure network would be hard wired, and might even have a different connector?
I would still consider a physical solution. Two metal devices with a hinge, hasp and lock, attached to the socket and the back of the PC will stop them switching cables? ( a bit like the old pillory or stocks), mess with that and you would be in BIG TROUBLE as it would be undeniably, totally deliberate?
Mind you, I am talking of environments where the Official Secrets Act took precedent over AUPs :eek:
I think I can see what you are saying – if a user connects the PC to another switch say on a wireless AP that may not be behind the firewall or if it’s a laptop take it home, they will be able to download something and then connect it back to the original switch and run this freshly downloaded app??
If this is what you are worried about the best ways to stop it are to use a Group Policy to stop the user being able to install a program in the first place and tie the MAC address to the specific port on the switch – obviously you will have to do this with all ports on all switches and this is not very practical in some/most cases.
A good practise to do it to not have any unused Wall Sockets connected to a switch port in the first place to prevent someone plugging anything in to the network in this manner and to shut down any unused ports on the switch – if the switch supports this.
This other switch port, or wall jack that you don't want him to connect
to, should not be available. Why play cat and mouse? Disable or remove the offending
jack, or put a surveillance camera there and watch if someone is playing with it.
:cool:
Yes, exactly this is what I am looking for.Quote:
if a user connects the PC to another switch say on a wireless AP that may not be behind the firewall or if it’s a laptop take it home, they will be able to download something and then connect it back to the original switch and run this freshly downloaded app??
At work I have got in a Lab 20 walll jack sockets for internal network (let us call them internal socket), a one desktop is connected to each socket.
there are additional another 3 sockets in the same lab , to access internet (let us call them internet socket),,,these sockets are on different switch.
Some time a user unplug the desktop from internal socket and plug cable to internet socket,,,to access the net.
They are not allowed to use there own PCs in the lab (i.e. They can not use thier laptop).
Is there a way to deny the user from connecting back the cable to the original switch if he unplugged the cable from internal socket (original switch) and plugged to internet socket ,,,
Hey Hey,Quote:
Originally posted here by zillah
Yes, exactly this is what I am looking for.
At work I have got in a Lab 20 walll jack sockets for internal network (let us call them internal socket), a one desktop is connected to each socket.
there are additional another 3 sockets in the same lab , to access internet (let us call them internet socket),,,these sockets are on different switch.
Some time a user unplug the desktop from internal socket and plug cable to internet socket,,,to access the net.
They are not allowed to use there own PCs in the lab (i.e. They can not use thier laptop).
Is there a way to deny the user from connecting back the cable to the original switch if he unplugged the cable from internal socket (original switch) and plugged to internet socket ,,,
I'd suggest setting port based authentication... Specifically port security via MAC Address with shutdown mode... Register the valid Desktop MAC Addresses with the switch and if anything else is plugged in that port will shutdown, generate a syslog message, and the LED will indicate an error... You will then manually have to re-enable the port...
Another, possibly better, solution would be to implement 802.1x... Set it up on the switch and then pre-authenticate each of the Desktop machines... They'll all work on the network but if another PC is plugged into one of the ports, it won't be authenticated and won't function... just ensure the users don't have access to the credentials... (which should be easy in a properly secured lab).
Peace,
HT
Hmmm,
As far as I know a "switch" is a pretty simple device for handling connections, and is not really a security tool. I would expect that the answer to your question is "no", as the switch is probably not sophisticated enough to spot the difference between a machine being logged off or just powered down. And connected to another switch, then reconnected.
I would say that you need servers to monitor and control this.
If your connection to the internet is NOT through a server, then you have a big security hole. I do not know what sort of logging you have on your intranet and internet at the moment. We would need that information to suggest a practical and cost effective solution.
I have some questions:
1. Which machines are actually ALLOWED to use the three (3) internet sockets?
2. Are they part of the twenty (20) in the laboratory?
3. Under what circumstances is internet connection allowed?
I am still attracted to a physical solution ;)
You can get small, lockable, metal boxes that mount on the wall.
They are meant to hold master keys or whatever, and you usually see them on the wall in the security guard's office?
Cut out the back, and attach them over the internet sockets. Then if anyone wants to use them, they have to come and ask, and sign for the key?
Please remember that there are two connections to a PC, so the wall socket can be bypassed by another cable from the machine.
Hey!, how about other vulnerabilities?
1. Do your machines allow 3.5" floppies?
2. Do your machines allow DC and DVD drives
3. Do your machines allow USB connections.
Please give us a bit more information on your situation and requirements.......we will try to suggest a security solution :)
HT already has posted the best security solution.
Use port level authentication.
In other words only a PC with the specified MAC address can operate on a certain port.
Hence if a user unplugs a PC and takes it to the socket where the Internet is connected to, when he tries to plug it in the switch will recognize that is has a different MAC to the PC that should be connected and will close down the port until it is administrativley opened again.
Problem solved.
If there are any wall outlets that are connected to the switch still but are not being used - disable/disconnect them.
Why?Quote:
If your connection to the internet is NOT through a server, then you have a big security hole
All my internet connections use either via a Firewall, Router with ACL's, Websense box etc in some cases all of them - it does not have to be through a server to be secure at all.
A switch can also be a very good security tool if configured properly - it is the first thing that is used when connecting to a network internally - hence it now becomes the first line of defense so to speak. Yes it can't be soley relied upon but it can still be and extra 'aid' and a very valuable aid, in securing a network.Quote:
a "switch" is a pretty simple device for handling connections, and is not really a security tool
Thanks for this advice, I guess you are talking about anyother PC to be plugged to a specific port.Quote:
if anything else is plugged in that port will shutdown
What I am looking for is: the same PC , if it is unplugged from a specific , it should not have been plugged again to the same port .
You wont be able to do that as unplugging it from a port is no different from turning the PC off as far as a switch is concerned. What you can do is to prevent it from being plugged in to anyother port on your network - using the port authentication protocol mention in mine and HTregz's posts.
There maybe some script your could employ that disables the NIC if is senses that a cable has been unplugged - but writting that is a touch over my head!
Damn, I use mine as one. ;) Can you think of another tool, besides a router that has limited ports available, that can limit "physical" access to network segments? Example... only those comming in on port 1, 3 and 5 can access port 9. Perhaps port 9 has a VPN device on it so when a certain say... URL is typed in a browser the pathway uses the VPN versus the normal gateway but only to a specific goup of peeps.Quote:
and is not really a security tool.
nihil,Quote:
Originally posted here by nihil
Hmmm,
As far as I know a "switch" is a pretty simple device for handling connections, and is not really a security tool. I would expect that the answer to your question is "no", as the switch is probably not sophisticated enough to spot the difference between a machine being logged off or just powered down. And connected to another switch, then reconnected.
I would say that you need servers to monitor and control this.
If your connection to the internet is NOT through a server, then you have a big security hole. I do not know what sort of logging you have on your intranet and internet at the moment. We would need that information to suggest a practical and cost effective solution.
A switch is one of your most important aspects of security... with VLANs, 802.1x, Port Authentication, Port Security, with switches above the 2950 (for example the 3550) you get the ability to define ACLs, etc... Cisco puts a lot of emphasis on security through switches...
As for servers to monitor and control this??? Servers a complex entities... introduce something too complex into your scenerio just gives room for more holes and problems... Now 802.1x would most likely have a back-end RADIUS or TACACS server... but nothing that your information is directly passing through.... Using servers directly in line of network communication is something that Windows Admins that don't know other hardware do.
There are better and more effective ways to accomplish logging... as for your Network Security.... it should be done by Networking Devices..
As for the OP of this thread... the realistic suggestions have been made as far as switching security is concerned... They require a bit of work and playing around will but will do what is required... he sounds like he wants an easy fix...
If he doesn't want the natural and available network security then nihil's suggestion of lock boxes over the jacks is the next best solution.
I suppose you could also use Network Access Quarantine Control available with W2K3 and IAS but that's generally for remote users.
Peace,
HT
or maybe manufacture your own patch leads for the 'internet sockets'
RJ11 plug instead of RJ45 ?
[PC < - RJ45 --------- RJ11 -> internet socket]
[PC < - RJ45 --------- RJ45 - >Intranet socket]
In several factories I worked in [in my previous life as an electrician], to prevent loss of plug tops
the factory fitted 13A sockets with square L and N pins but a round earth pin
just a variation of a theme
My understandin to what you are saying (switch port security using MAC address not 802.1x), is : (correct me if I misunderstood) :Quote:
Specifically port security via MAC Address with shutdown mode... Register the valid Desktop MAC Addresses with the switch and if anything else is plugged in that port will shutdown, generate a syslog message, and the LED will indicate an error... You will then manually have to re-enable the port...
If I have got two PCs 1, and 2 with PC1 MAC addresses 18-00-46-06-FB-B6, and PC 2 MAC addresses : 200-08-74-4D-8E-E2. PC 1 is connected to SwitchA fa0/4
1- SwitchA(config)#mac-address-table static 18-00-46-06-FB-B6 interface fastethernet 0/4 vlan 1
2- To allow the switchport FastEthernet 0/4 to accept only one device I have to enter port security as follows:
SwitchA(config-if)#switchport mode access
SwitchA(config-if)#switchport port-security
SwitchA(config-if)#switchport port-security mac-address sticky
3- In the event of a security violation the interface should be shut down.
SwitchA(config-if)#switchport port-security violation shutdown
4- If I unplug PC1 from switchA fa0/4 and plug PC2 (or any other PC) instead, yes there is security violation since the MAC address for any other PC is not as MAC address for PC1.
5- If I unplug PC1 from SwitchA fa0/4 and Plug it to any other device (switch, router, PC) and then Plug back PC1 to switchA fa0/4 , there is no security voilation.
I'm looking at this...Quote:
Originally posted here by zillah
Yes, exactly this is what I am looking for.
At work I have got in a Lab 20 walll jack sockets for internal network (let us call them internal socket), a one desktop is connected to each socket.
there are additional another 3 sockets in the same lab , to access internet (let us call them internet socket),,,these sockets are on different switch.
Some time a user unplug the desktop from internal socket and plug cable to internet socket,,,to access the net.
They are not allowed to use there own PCs in the lab (i.e. They can not use thier laptop).
Is there a way to deny the user from connecting back the cable to the original switch if he unplugged the cable from internal socket (original switch) and plugged to internet socket ,,,
so from what I understand (maybe we're losing something in translation here as their appears to be a bit of a language barrier)... You have 20 machines... Each of these are on your intranet... You also have three connections for internet access... Outside machines are not allowed..
So when do these "internet ports" actually get used... If you don't want users network hoping why are they there? What I'm thinking is each of your 20 LAN ports get's port security (following the steps at http://www.cisco.com/univercd/cc/td/...g/port_sec.htm... I can provide you with further assistance on this if you desire)... The machines that are allowed to access the internet would get the same setup...
Basically what we're getting at is that if you have unmonitored (i.e. No person in the room)... ports... you can't stop people from switching machines back and forth if that's the purpose of the ports... If each of these ports should have a single machine and not have their plugs swapped, set the mac address on each port to that specific machine.
Peace,
HT
Thanks HTRegz for your conribution,,,I have done alot of practical scenario related to MAC port security.Quote:
I can provide you with further assistance on this if you desire)... The machines that are allowed to access the internet would get the same setup...Code:http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/12_1e/swconfig/port_sec.htm
I started to believe that we can not implement that.Quote:
you can't stop people from switching machines back and forth if that's the purpose of the ports...
I had some of the same problems when I had to administer a school network. The students would move the whole computer and end up breaking the NIC, port, or cable.
Prevent the computer from being moved.
Bolt it down to the table.
Tie-wrap the cables to the table.
I think that Network Access Quarantine Control is also a very good, if you have the money for that type of option.
You could also increase the port timeout. On Cisco switches there is a setting to prevent just that moving from port to port to port. Increase the setting, I think the default is 5 minutes.
It is called Port Hopping and it is configurable on a Cisco 2950 switch.