Comware

Our network supports a three floor health care facility for university students. We want to lock down Ethernet ports so that students or other outside entities can not plug in their laptops and get network access. I have created a list of all of our known, authorized MAC addresses. We are trying to decide if we should use mac-based port authentication against a radius server or use the port security feature. Our network consists of 14 Procurve 2650 switches (with 4 or 5 per floor) all connected to a Procurve 5406 in a star topology. The 5406 is located in our server room and also connects all of our servers. We are uncertain about radius due to the fact that if the radius server fails or both the primary & secondary servers fail, or if the primary fails, but the secondary radius server does not get queried then all of our users will be locked out until the primary radius server is back online. Port security does not seem to have this disadvantage.

I was hoping that a few of you network experts could discuss the pros and cons of each solution.

Thanks,
-John

Also, what happens to the Port Security settings if the 2650 loses power?

Thanks,
-John

hi john

you make create port security enable on your 2650 switch related ports.

(config)#port-security[port-list]learn-mode [static-continius] address-limit[1-32]action[send-disable/send-alarm]

port-security :main command

port-list ethernet ports on run port security
learn-mode :learning mode switch each device learning mac address auto. and after write on port.

static mode:switch power loss or restart port security mac information not loss on switch

continius:switch power loss or resatart port security mac information loss on switch

address limit :one port assign maxima 32 mac address

action :send disable :occur port-securiy intrusion on port ,port is disable
send alarm:port-security intrusion on port
send alarm procurve manager and switch security intrution logging and port closed ,snmp,icm etc. portocol trafic.

cenk

Limit each port to accept the first 802.1X-aware device and define an action for the switch when it recognizes additional devices(config)# port-security <PORT-LIST> learn-mode port-access action <NONE>â The default learn mode action none enables additional devices to connect through an authorized portâ The send-alarm learn mode action generates a syslog message if additional users attempt access â The send-disable learn mode action places the port in unauthorized state if additional users attempt accessâ Ports must be set at autocontrol mode
Setting learn-mode to port-access causes the port to accept the MAC address of the first 802.1X supplicant but reject any additional MAC addresses. You can configure port-security to disable any MAC address after the first one learned through that port and send an alarm to the log indicating a security violation. If you choose to disable the port, all stations attached to that port will be unable to access the network, and the port will need to be manually enabled after the security violation has been cleared.

cenk</NONE></PORT-LIST>

With that many switches I would definitely go with the centralised RADIUS server method. It's too time consuming to keep adding/removing mac-addresses on each switch, plus you may have more mac-addresses than each switch can keep in it's configuration.