EXOS | Mac-Locking vs Limit-learning/Lock-learning

[csantos]

Hello,

We’re trying to upgrade our security level in the Access layer where we have EXOS stacks.

So, I was thinking to use Mac-locking to achieve our goals, because it is something that we already used in another customer, so, it’s very familiar.

However, a colleague of mine told me about limit-learning/lock-learning features. So what do you think about those? Should I go with mac-locking, or limit-learning/lock-learning?

Thanks in advance,

César Santos

[csantos]

Hi Jeronimo,

We’re alredy using DHCP snooping and 802.1X auth and Mac Auth. 

My problem here is with some “smart ones” that insist to connect some old Hubs to the network, even when the network admin explicitly says not to. The problem with those old Hubs is that they don’t send BPDUs to my EXOS stack. If they did, the bpdu-restrict feature would just simply put the port on disable state. The goal is that one. When someone connect an hub to the stacks, if the stack see more than just two MAC addresses (PC plus Phone) on the fdb table for a particular port, then it disables the port. I think Mac-locking is the best way to do that, because that will force the “smart ones” to contact the Network Admin. 

Regards,

César Santos

[jeronimo]

Mac Locking is probably better than nothing at all.

But you should probably evaluate the alternatives including dynamic authentication using Radius (Mac Auth / EAP) or maybe DHCP snooping.