physical network security

[rasczak]

I'm on a project that needs a physical solution to a user accidentally plugging his or her laptop and accessing network resources. I'm very short on the network experience list (as you can tell from a lot of my posts in the sub forum).

What we have is an private network running active directory, so user and computer authentication is one security boundary. However, are there any solutions that would prevent a user from plugging into a wall jack and sniffing around? aside from actually killing the port? I remember a product at one time made by cisco that had port "sensors" where if the MAC address did not match the port would shut off.

 

[jlazzaro]

what you mentioned isn't a product, its 802.1x port security. most any Cisco Catalyst switch supports port-level MAC security.

http://www.conetrix.com/Blog/post/Cisco-Port-Security-and-Sticky-MAC-Addresses.aspx

 

[seepy83]

One bit of caution - Although Port Security may be necessary in some situations, it has the potential to be a PITA to manage.

 

[airdata]

what you mentioned isn't a product, its 802.1x port security. most any Cisco Catalyst switch supports port-level MAC security.

http://www.conetrix.com/Blog/post/Cisco-Port-Security-and-Sticky-MAC-Addresses.aspx

Port security. Wouldn't be too hard to configure on a cisco switch. There are probably other solutions out there too but I'm a cisco guy.

 

[hellotyler]

UAC (user access control) is an option on many wireless routers, so only pre-approved MAC addresses can connect. Easily spoofed from what I hear, but it would keep the general user from accidentally connecting. I know Airport offers this, but I'm not sure what else.

 

[AstroGuardian]

Dude, you mentioned active directory. So an external computer which is not member of the active directory can not possibly sniff anything as long as other computers don't have the "Share with everyone" enabled on their shared folders.
Further more, the communication between the active directory members among themselves and towards the domain controllers is encrypted so sniffing is not a possibility there.
I can't think of any other way to physically secure the wall jack aside from plugging it out of the switch.

 

[drebo]

Dude, you mentioned active directory. So an external computer which is not member of the active directory can not possibly sniff anything as long as other computers don't have the "Share with everyone" enabled on their shared folders.
Further more, the communication between the active directory members among themselves and towards the domain controllers is encrypted so sniffing is not a possibility there.
I can't think of any other way to physically secure the wall jack aside from plugging it out of the switch.

There are other things which an unauthorized device can do which are potentially harmless to a network. Also, there's lots of traffic that can be intercepted even if the device is not part of the AD domain.

To the OP:

You could use NAC if the site is very large, to the point where Port Security is not manageable. If the site is smaller, then Port Security is the easiest way to get this done. You can also configure Port Security to learn the first MAC that's plugged in to the port and only allow that device.

Also, there are a couple of companies that make locking keystone caps which you can use to physically secure an unused jack.

 

[AstroGuardian]

Also, there are a couple of companies that make locking keystone caps which you can use to physically secure an unused jack.

Damn right. Forgot to mention that. That's probably the best physical solution for you.

 

[Emulex]

NAC - security to the edge. your policy should enforce on the edge switches (to ports) and wifi - mac addresses are stupid easy to forge. need more than that.

 

[RadiclDreamer]

One bit of caution - Although Port Security may be necessary in some situations, it has the potential to be a PITA to manage.

No potential, its a giant pita to manage unless you are just limiting the number of macs to the port to keep people from plugging in their own network gear

 

[Nothinman]

Dude, you mentioned active directory. So an external computer which is not member of the active directory can not possibly sniff anything as long as other computers don't have the "Share with everyone" enabled on their shared folders.
Further more, the communication between the active directory members among themselves and towards the domain controllers is encrypted so sniffing is not a possibility there.
I can't think of any other way to physically secure the wall jack aside from plugging it out of the switch.

There's a lot more than just AD and SMB traffic on a normal network and a lot of it is going to be unencrypted. And if they can plug in and get an IP they can gather usernames, bruteforce passwords, DoS systems, etc.

 

[RadiclDreamer]

Dude, you mentioned active directory. So an external computer which is not member of the active directory can not possibly sniff anything as long as other computers don't have the "Share with everyone" enabled on their shared folders.
Further more, the communication between the active directory members among themselves and towards the domain controllers is encrypted so sniffing is not a possibility there.
I can't think of any other way to physically secure the wall jack aside from plugging it out of the switch.

I cant even begin to start explaining how wrong this is

 

[degibson]

Port security. (snip)

This is the best idea I know for physical security concerns.

Disallow link-level activity, based on MAC. You need to use midrange switches to get complete security, so it ain't cheap... but it works.