How Do You Handle Ethernet Port Management?

MTL-Stalker asks: "I am currently investigating the best way to handle Ethernet port management for an organization with over 75,000 Ethernet ports spread out over 700+ sites. I was wondering how members of the Slashdot community are handling this issue in their organizations? Obviously this is as much a business process issue as a technological solution. In today's threat-filled networks, it seems like asking for trouble to rely on a simple switch based 'port enabled/port disabled' methodology. Do you think Cisco-style port security (tying a MAC address to a particular port) or PACLs (port access control lists) are worth the effort? Are products like Cisco Campus Manager or HP OpenView worth the cost and deployment headaches? Do they address your security concerns? How many of you are using homegrown scripting and/or SNMP solutions? How many ports can you effectively manage with these solutions? I would also be interested in knowing what industries these solutions are being implemented in."

Comments

My dad's solution

[The MAZZTer]

He just blocks everything except HTTP/HTTPS and FTP, so I'm stuck using Tor for anything else. >:(

Re:My dad's solution

[Harry Balls]

The OP is talking about physical Ethernet ports, not about TCP or UDP ports.

Re:My dad's solution

[Crimsane]

You're obviously pretty young, so I think some advice is in order.

If your dad won't forward you any ports for torrent traffic, walk up to your him and say this:

"Hey dad, can I get some ports forwarded to me for bit-torrent please? It looks like a pretty good program, but of course you already know that, I took a peak at the network traffic and found that you were pretty fond of it."

pause

Maybe I should ask mom and see what she thinks?

What about 802.1x security ?

[CineK]

This way you could tie particular users to their VLANs, not the machines to the ports, which can be quite annoying when a user wants to change his/her desk.

802.1x should be combined with some decent endpoint security solution
(see recent Gartner reports on this)

HTH

Marcin

Re:What about 802.1x security ?

[Philip K Dickhead]

VLANs can be a headache too - especially with 802.1x, which requires replacing your existing access layer switches with 802.1x capable ones. You DO get the benefit of integrating your wireless access infrastructure with the copper stuff.

Are yu all/mostly Windows (2000+)?

Look closely at Windows Domain and Server Isolation. It is an IPsec based infrastructure security solution, all managed with existing infrastructure. The IPsec policy agent is on the OS, and policy is easily managed centrally by Active Directory and Group Policy. It really is great - and can interop with other IPsec stacks like Linux and Solaris. The default auth mechanism is Kerberos - but x.509 can be used in parallel for interop. Kerb is dead easy.

If this is even only an 80% solution, it should be explored. There are no hardware costs in most cases, it can be phased in without field visits, and you probably already own it.

http://www.microsoft.com/technet/security/topics/a rchitectureanddesign/ipsec/default.mspx

I wish that one of the big Linux vendors would do something like this with IPsec and OpenLDAP. We have spent years matching the desktop, when developing advanced infrastructure management is where the winning game has moved.

Re:What about 802.1x security ?

[GoRK]

I came into this discussion fully expecting to see a nice breakdown of the various merits of 802.1x yet I only see your ONE SINGLE POST that even acknowledges that 802.1x even exists?!?! Not only is it widely supported, it's pretty much the only standard for port based security before you start getting into high level protocol stuff like PPoE or other tunneling protocols. Tying MAC addresses to ports is as ridiculous as it is insecure.

I thought that there were at least some people on slashdot that were actually IT pros...

Re:What about 802.1x security ?

[maxhead]

Actually, you do not necessarily have to replace the access layer switches to enjoy dot1x. Placing a dot1x-capable switch upstream that supports mulitple logins on a single port can be an intermediate step and bring most the benefits.

In general, I advise customers to lock down every port in their network with 802.1x and to provision guest VLANs that are GRE-tunneled to a switch in the DMZ. This segregates all the guest traffic from corp traffic at L2 so the only way for a guest to access local corp servers is via the internet and back through the corp firewall rules.

Re:What about 802.1x security ?

[Rekolitus]

802.1x over Ethernet isn't necessarily secure, to my knowledge.

Take a computer plugged into an 802.1x port. Unplug computer, plug in hub, plug computer into hub, plug laptop into hub, masquerade MAC address.

802.1x over Ethernet can't detect hubs.

Re:What about 802.1x security ?

[Philip K Dickhead]

Clever, that last bit.

IPsec can do similar at layer 3 - if you don't need layer 2 isolation for non-IPsec devices on the same segments.

Re:What about 802.1x security ?

[MTL-Stalker]

We have been looking at 802.1x for way in the future. The problem is that it's a very heterogeneous environment with literally 100s of switches (core, aggregate & edge) already deployed. How do you get all those old network printers to do 802.1x. Nevermind the fact that going around and re-configuring thousands of servers and desktops is really out of the question. We could recommend upgrades to the core switching fabric but anything that would require upgrades for the edge devices is out of the question. We're talking about 75,000 end user Ethernet ports/jacks.

Re:What about 802.1x security ?

[MTL-Stalker]

802.1x is SLOWLY making it's way into large enterprise deployments. Generally this has started on the wireless side, because most wireless equipment is relatively new and the devices connecting to wireless APs are mostly intelligent devices with software stacks that can support 802.1x.

As I mentioned in a previous post, the idea of having to do OS reconfigurations on all the workstations and servers is out of the question in an organization this large. Also legacy equipment like printers, networked photocopiers & even NAS devices make it largely unfeasable at the moment.

The only hope for 802.1x is to slowly upgrade all the switches and legacy equipment over time to 802.1x capable devices, this could take years.

Re:What about 802.1x security ?

[macdaddy]

This happens to be a horrible solution. This completely defeats the purposes of Traffic Engineering. Now all traffic is encrypted between IPSec end-points. This eliminated PBR. This eliminates access-layer filtering at L3 and L4. MPLS? What's that? CoS and QoS is effectively defeated as well. If you implement a solution based on this technology then you might was well save yourself some big bucks and start buying dumb switches instead of the entreprise grade gear from one of the big name companies. This is not a good solution for this application. For securing traffic in a DMZ back to the firewall? Sure; that's a slick use of this tech. There are far better established methods and technologies for accomplishing the same thing. Those other ways would also happen to be what we network engineers call "standards".

Re:What about 802.1x security ?

[macdaddy]

You can deploy the required changes quite easily with AD and SMS. With any network that has 75k access ports you must already have some form of desktop management software in use, such as SMS. If you're running a Windows network then you've surely stepped up to AD by now. 1X can be controlled with group policies. I know that XP has 1X enabled by default. I don't know about 2k.

You don't enable 1X on access ports for servers. Your servers should be segregated not only on to a separate VLAN but, in anything but the smallest of networks, onto separate switches. If you want to provide interface security in these subnets you should simply use MAC locking. Also set up a SNMP trap monitoring system to alert you of security violations on these ports.

As far as network printers go you should already know which port any given printer is on since these printers should be in separate VLANs. You should not place a printer in the same VLAN as desktops for security reasons. There have been many rather slick hacks over the years involving taking a printer offline (with a DoS or physically unplugging the printer) so that an insider can become that printer and accept printjobs containing confidential information. No matter how much we preach security and how seriously some companies take security almost no company has a printer clause in their security policy. Ie, how are printjobs containing sensitive information handled? Can they be printed to a printer in an area with a lower security level? How long can a sensitive printout sit in the output bin of a printer? etc. Always place printers in another VLAN. Ideally you'd deny all access to these VLANs except from known print servers. You don't use 802.1X in the printer VLANs. Instead you use MAC locking and ingress/egress ACLs.

Contrary to popular mis-conception IEEE 802.1X is not enabled on every port across the LAN. It is ONLY enabled on access-layer interfaces that face users. You do not enable it on infrastructure ports (obivously) or on server ports. For an auth failure you can default to either no access or you can automaticlaly place that port in a specific VLAN. That VLAN has restricted access across the campus where you can do all sorts of things to it. You can set up a user registration system so that the user can establish a guest pass for a specific amount of time (think hotal guest management software). You can also force it through a VPN termination device such as a firewall or a VPN concentrator. I recommend this for wireless users. That way they have to use VPN to complete AAA and gain access to their internal network resources. You could create a honeynet to see what this user with a failed connection is trying to gain access to. There are all sorts of things you can do.

If your infrastructure doesn't support a technology that you want/need to role out then you're essentially screwed. It happens. In a couple years a new tech will come out that a customer of mine will want to run. This new tech is not available on their hardware they already own, even with a code update. Their 3-year old network will have to be replaced. This comes down to a business decision. Are the added features valuable enough to justify the costs of the forklift upgrade. Sometimes yes, sometimes no. That not the decision of us technical people to make. We present the summation to the business people and let them make the call.

A perfect example of this is with IEEE 802.af. 802.af was ratified in December of 2003. Prior to that date all previously shipped PoE devices were pre-standard and many were incompatible with the final standard (such as Cisco's implementation). You spent $250k in 2002 to install a new 10/100 network with redundant GigE backhauls to a partially-meshed distribution layer that has a fully-meshed ATM core. By all accounts it's a nice network. Now you want to deploy VoIP across the network and you're finding that your 2002 switches don't support PoE. They don't support voice VLANs. They have limited QoS

Re:What about 802.1x security ?

[Philip K Dickhead]

It is not encrypted.

It is encapsulated, with a NULL enc type. You wrapped your packet in another header - like any enc. This one has Keb auth associated with it - and uses RSA/SHA-1 to validate the authentication. There are many more dynamic rules availble to you by policy than 802.1x - which is a simple gatekeeper.

There are issues with some access layer filtering and prioritixation - but not unworkable, depending on your vendor.

QoS will never save your butt from data theft or worm traffic.

You gets some - you loses some. All design and ops issues are a matter of tradeoffs.

BTW: IPsec, x.509 and Kerb5 are engineering standards.

Re:What about 802.1x security ?

[GoRK]

Well any type of 'authenticate then forward' type port control is vulnerable to this sort of thing, and so is simply defining the allowed mac address on a port. A shadow host attack as you have described is certainly possible against 802.1x but the usefulness of such a configuration would be somewhat limited without cooperation from the targeted computer or the ability to disable the target computer after access is granted. It's not as if the shadowed host has full network connectivity; in fact it has far from iif there is no cooperation from the computer targeted by the attack. In any case I believe 802.1x would be sufficient security for making sure that, say, a college dorm room doesnt turn into an ISP.

You can somewhat defend agains this type of attack without physical security as well. You can force the port to gigabit speed, greatly reducing the probability that someone has a hub-type device to perform the attack (you could still use a l2 bridge attack) or you can disable the port entirely if the physical link goes down.

If you require more security than this you should probably be running PPPoE or IPsec on the wire instead. There are a number of ethernet cards capable of IPSec offload and wireline speeds...

Guest-Intruder VLAN

[chill]

I've always had good luck with not necessarily tying a MAC to a port, but rather a list of approved MACs. MAC not approved gets automatically shunted to an isolated VLAN. If they bring up a browser all they see is a "welcome guest, call IT" screen. Both Cisco and HP switches can do this.

Re:Guest-Intruder VLAN

[Anonymous Coward]

I've always had good luck with not necessarily tying a MAC to a port, but rather a list of approved MACs.

You guys always try to do things the hard way. For true ethernet port management just use this.

Re:Guest-Intruder VLAN

[Anonymous Coward]

I skip trying to keep track of MACs (too easy to forge), in fact I skip Ethernet level security almost entirely (too much to keep track of).

I say "almost", since I do have each switch trunk a separate VLAN to each port (to keep them isolated), and I have the switches filter everything except PPPoE. The switches are managed through a physically separate control plane network, where extensive security is in place. Various systems monitor the control plane network in detail, all traffic on that network is recorded to worm, and the entire network area is shut down if any anomaly is detected(i.e. any attempt to contact port 80 on anything results in a building lock-down, since there is no reason web traffic would exist on the control plane). The control plane is not reachable from the regular network, any user-facing ports, or the Internet.

On the forwarding plane, users must establish a PPPoE connection to reach the VPN concentrators, and then must establish a L2TP or PPTP tunnel to access the intranet or the Internet. All traffic from the VPN tunnels is forced through firewalls and IPS/IDS systems, before being allowed on it's merry way. Inbound connections to user systems are prohibited, unless the individual user's profile permits limited access. Since nothing can be done, except through the VPN tunnels every packet gets examined. Management of the PPPoE concentrators, VPN concentrators, routers, firewalls, and network control/monitoring servers is again isolated to the control plane network.

Isn't that a lot of overhead? Yes it is.
Does the network yield maximum performance? Not by a long shot.
Is it inconvenient? Quite.
Expensive? you bet.

But, it is rather secure, and quite homogeneous, making security management's job much easier. No pesky individual Ethernet ports (or wireless APs for that matter) to deal with, just a database of user profiles, and standardised configuration templates.

-e

Re:Guest-Intruder VLAN

[WilliamSChips]

Is that an ethernet port on one end and a power socket on the other? You, sir, are a fucking genius.

Re:Guest-Intruder VLAN

[Anonymous Coward]

I have the switches filter everything except PPPoE. The switches are managed through a physically separate control plane network, where extensive security is in place. Various systems monitor the control plane network in detail, all traffic on that network is recorded to worm, and the entire network area is shut down if any anomaly is detected(i.e. any attempt to contact port 80 on anything results in a building lock-down, since there is no reason web traffic would exist on the control plane). The control plane is not reachable from the regular network, any user-facing ports, or the Internet.

Where do you work, the NSA?

Re:Guest-Intruder VLAN

[starfishsystems]

Yep, that plus a bit of homegrown SNMP management for the switches and you've got the problem basically under control. Host connectivity is controllable remotely.

The day will come when devices identify by certificate rather than by MAC, and that will make this architecture firmly secure.

Re:Guest-Intruder VLAN

[GoRK]

I dunno; sounds like a typical ISP setup for cable or DSL customers to me --

Re:Guest-Intruder VLAN

[computational super]

Where do you work, the NSA?

No, actually that's just his dad's home network.

Re:Guest-Intruder VLAN

[cybrix]

Is that what they use for broadband over powerline?

Re:Guest-Intruder VLAN

[MTL-Stalker]

That's quite the setup.

How would you handle NAS devices?

How would you handle network printers?

Niether of these class of devices generally has PPPoE capabilities.

Re:Guest-Intruder VLAN

[glsunder]

I might have to make one, put it a glass case and label it: "Break incase of internet-challenged user" and hang it in my office.

Re:Guest-Intruder VLAN

[Anonymous Coward]

NAS devices are not allowed.

Network printers have a dedicated router attached, which performs the authentication.

-e

Re:Guest-Intruder VLAN

[Anonymous Coward]

Bah. That's just the ultimate 802.3af ( Power over Ethernet ) solution.

Serious business

[voice_of_all_reason]

The internet: Homework Help for both teenagers and network administrations :)

mac security

[v1]

Given how easy it is to change your mac address, (I can do this at will on my ethernet AND wireless) I would hope no serious security system relied entirely on that one factor. We have to assume the serious criminals have all the easy angles covered.

Re:mac security

[Jeff DeMaagd]

It can be very easy to change the MAC. The Intel gigabit NICs seem to offer that feature in the PROSET software in Windows, and the OS X driver for same NIC offers it too.

I wonder how easy it is to find a MAC that is valid for a network? It sounds like you'd already have to have access to the network or a computer that is authorized for the network to get the MAC.

Re:mac security

[Rallion]

Don't forget the social engineering aspect.

Re:mac security

[MoxFulder]

First of all, basically *any* NIC can have its MAC address changed in software. At least every one that I've *ever* seen. Not having that ability would be a misfeature in my opinion, as it would cause you problems when you changed the NIC in your computer, for example, or with those stupid cable modems that only allow one specific MAC to be connected to them.

Secondly, it's trivial to find a MAC that is valid for a network if you can plug into an *unsecured* port. For example, if you plug in to an ordinary unsecured switched port, you can gather MAC addresses simply by listening for broadcast packets, such as ARP packets, which are supposed to go to the entire LAN.

I've never used big iron network hardware personally, but I assume that they prevent even broadcast packets from going to a port until they authenticate the MAC address of the connected device. I still don't see that being very secure, since once you are authenticated, you can easily gather *everyone else's* MAC address, again by listening for ARP packets :-) Shutting down ARP entirely would probably break too many features of the LAN... So the way I see it, securing switch ports with MAC address keying could at best prevent a complete outsider from getting into the network, but couldn't stop an inside job.

Re:mac security

[theLOUDroom]

Given how easy it is to change your mac address, (I can do this at will on my ethernet AND wireless) I would hope no serious security system relied entirely on that one factor. We have to assume the serious criminals have all the easy angles covered.

Let's go a little further than that:
MAC addresses are not a secure authentication method. It's like asking someone's last name.

Let's say I'm joe blackhat with a laptop:

1. I unplug a PC
2. I plug that ethernet cable into my laptop.
3. It grabs the mac address of whatever was plugged in.
4. I plug in my laptop with that new mac address.

If you automate it, we're talking a matter of SECONDS here.

Security of this type is s total joke. There are right ways to protect a network and this is not one of them.

Re:mac security

[jonadab]

Given how easy it is to change your mac address

The question isn't how easy it is to change your MAC address, but rather how easy is it to find out what to change the MAC address to. (I'm not sure it's that much harder, though, assuming a device that's normally plugged in is present so you can snoop on it.)

> I would hope no serious security system relied entirely on that one factor

No serious security system relies on *ANY* one factor.

Tying a MAC address to an ethernet port doesn't solve all security-related problems, but it does help somewhat with the specific problem of employees just being generally far too careless about what systems they plug into the LAN, which *can* be a siginficant thing, in some situations.

Obviously you will still want other forms of security.

Re:mac security

[Alioth]

A large proportion of break-ins (particularly malware type break-ins) are not due to malice: quite often they are because a contractor/employee brought in their personal malware infested laptop and saw fit to connect it to the corporate network. Nearly all the problems I've seen on company networks are not due to malice but due to people doing silly things like this.

A huge number of corporate network problems can be solved just by keeping the honest people honest with things like MAC address approval.

Re:mac security

[ReaperEB-Moo]

sure changing the MAC address is easy, but if you're using the "STICKY" MAC functions on your Cisco Switches, changing the MAC will result in loss of connectivity. Once your user plugs their workstation into the jack, they workstation's MAC is paired to that port. If down the road, you need to replace the workstation/and/or/NIC, you'll have to clear the "STICKY" MAC on that port and pair them.

Re:mac security

[StikyPad]

I wonder how easy it is to find a MAC that is valid for a network?

Go to a "friend" / roommate / coworker / public computer and

ipconfig /all

It sounds like you'd already have to have access to the network or a computer that is authorized for the network to get the MAC.

Obviously anyone who has physical access probably already has legitimate access and just wants to cover their tracks, but many people leave their computers unlocked and/or many networks (especially educational) have public terminals.

Re:mac security

[pe1chl]

You can also mostly solve that problem with some access control in your DHCP server.
When it does not hand out a lease to everyone, a newly plugged-in laptop will not get an IP adress, will use a 169.254 address, and you block that at your routers and servers.

RADIUS

[Lehk228]

i would suggest using a RADIUS login to manage user access

since RADIUS was originally designed for ISP's managing users it is good dealing with hostile clients and other riffraff as long as you are on a switched network

Too easy...

[__aaclcg7560]

One port at a time! The best part is that you don't need to be an MCSE tech to figure that one out.

Re:Too easy...

[Anonymous Coward]

...but what do you need to an MCSE tech to figure out?

Re:Too easy...

[__aaclcg7560]

This, maybe? :P

Obligatory

[The Living Fractal]

"I read it as Ethernet Porn Management"

"In which case, I'd use a COMdom"

Feel the karma burn. Ahh but how, -1 Redundant, Offtopic or simply Overrated? Hit me with it.

TLF

Too many ports?

[drewzhrodague]

I am currently investigating the best way to handle Ethernet port management for an organization with over 75,000 Ethernet ports spread out over 700+ sites.

Uh, go wireless? There are a number of wireless options.

(The company I work for has a neat solution, but I am not allowed to talk about it(!!))

Re:Too many ports?

[WarlockD]

Not sure that's even an option. I don't think most commercial wireless AP's handle more than 15-20 people at once without a slowdown, and even if you stager to fill all 15 channels, the wireless traffic will just drive everything to a crawl. It also doesn't help if everyone is using WPA2, I don't know of many reviews on how well an AP can handle the encryption traffic.

Re:Too many ports?

[Fallen Kell]

And too bad that wireless network is a shared, half duplex network. Get much more then 20-40 systems that are in a closed area (like, I don't know, any standard cube farm) and your network just ground to a halt. Heck we hit limits of G networks in a laptop equiped presentation room with only 30 people in it. It seemed that a virus was going around at the time and the laptops needed to get a patch on boot up, which is not an uncommon event in a corporate environment. Well needless to say not a single laptop had even finished getting the update during the 2 hour presentation.

Wireless is meant to be used in addition to a wired network to expand your capabilities when a wire is not available. It is still no where near being a replacement yet.

Re:Too many ports?

[afidel]

Wrong. Wireless can be made to scale well if properly designed. I know that Cisco had a system installed at the MS main campus that supported hundreds of people in a conference room connected and watching fairly high bandwidth content.

Re:Too many ports?

[pyite]

(The company I work for has a neat solution, but I am not allowed to talk about it(!!))

Good, you wouldn't want to embarrass them. You know, servers can't exactly ride wireless. Where I work, we have more servers than desktops. In fact, we have more servers than employees (tens of thousands). So even if all desktops could use wireless (they can't), you still have 35,000 or so servers to deal with. Managing 35,000 switchports is not much better than 75,000. You still need processes and management software.

Re:Too many ports?

[jonoid]

(The company I work for has a neat solution, but I am not allowed to talk about it(!!))

So post as AC!

Re:Too many ports?

[jonadab]

> Uh, go wireless?

All these doors and windows are potential entry points into our fortress! How can we manage protecting against unwanted invasions at all those points?

I know, we'll get rid of the walls, and then there won't *be* any doors or windows!

Re:Too many ports?

[sigipickl]

Also, a 2.4ghz (b/g) or 5.8ghz (a) signal with any kind of strength can be an instant wifi killer. Wireless home phones, microwaves, or just another access point. my $0.02

Re:Too many ports?

[MadJeff]

Actually, they use Aruba for thier wireless, it is an awesome system. I've implemented it a couple of times and it rocks!

Re:Too many ports?

[afidel]

Then they switched, it used to be Cisco/Aironet =)

Re:Too many ports?

[commanderfoxtrot]

And most servers have at least 2 if not 4 ethernet cards/ports.

Re:Too many ports?

[pyite]

Yep, in general, where I am, servers have 1 production, 1 RIB, and 1 backup (as in data backup) connection at a minimum.

Re:Too many ports?

[commanderfoxtrot]

We have similar. But then they are all doubled for resilience.

Thing is, I've never seen a problem where we've needed doubled-up network cards...

Re:Too many ports?

[pyite]

We typically take the view that one server itself is not very valuable. If it dies, another takes over what it was doing.

Pro solution

[Ex-MislTech]

I'd recommend a pro solution, as they are not going to go away.

Any employee you might hire to custom make a solution could
die in a traffic accident, or get a new job, or die for some other reason.

You'd be stuck with a one man band application, that other ppl
would have to "fully" comprehend his coding nuances.

The security, stability, and maturity of a professional long term product
is going to help a lot if you are planning for further growth as well.

I'd find out the one that has the highest rating out there among
the pro solutions and go with it.

A smart man once said "Do what your good at, and find those that are
good at what they do and pay them if you need their services, and
do not try to be a jack of all trades."

The only other way I could see it is viable is to get in on a open source
app and contribute to it, but it sound like you need something the works "right now"(tm).

Ex-MislTech

Re:Pro solution

[Anonymous Coward]

Any employee you might hire to custom make a solution could
die in a traffic accident, or get a new job, or die for some other reason.

Gee, you really want that guy dead, don't you?

Why?

[Dolda2000]

I'm not exactly in charge of any large area networks, so I'm probably just ignorant, but why would you want to limit physical Ethernet access to begin with? All your actual services are properly authenticated, aren't they? Is it for DoS prevention or proactive security or something completely else?

Re:Why?

[Anonymous Coward]

I agree. I have to manage almost 10000 ports by myself. If I tried to turn on MAC filtering or even maintain a list of approved MAC addresses, then I would spend all of my time managing that list. What I would gain would be very little.

Re:Why?

[bhmit1]

B: Proactive Security

Large networks tend to be much softer once you are inside the firewall. The biggest selling point tends to be preventing a worm or virus from spreading while you get around to patching everyone's PC. But you could also consider that departements tend to install servers for the group, and the security group doesn't make sure it's hardened if it's not in the DMZ and doesn't contain really important data. But even with all that, there's the liability of people doing things from your network, such as running P2P and serving porn or illegal material. Large networks tend to be much more secure if you only allow locked down PC's on the network that are centrally managed (e.g. users don't have Administrator on machines connected to the network). And when bad things happen, you can know who's responsible so that management can take the appropriate actions.

Re:Why?

[Intron]

The one thing you might do is watch the traffic for MAC addresses that contain the manufacturer id for Linksys, NetGear, etc. to find unauthorized WAPs.

Netdisco

[arnie_apesacrappin]

As far as port management goes, you may want to look at Netdisco. If I recall correctly, UC Santa Cruz was using it to manage about 20K ports. It's open source, so you so should be able to customize it for your environment. I haven't run it personally, but the demo looks impressive.

When considering how to secure the ports, I think you have to find the balance between security and functionality. If you lock down each MAC to a specific port, how much time will you spend managing it? Whenever there is a connectivity problem, will you have to fight with the other groups assuring them that it isn't the network?

As a final thought, you generally get out of a network management system what you put into it. With a network as large as yours, there isn't a silver bullet to fix all of your problems. Whether you customize, roll your own or use vanilla off the shelf software, you need to figure out what makes the most sense for your business. Good luck. It sounds like you need it.

Netdisco

[Anonymous Coward]

Netdisco is an open source switch management solution. Shows you MAC, IP and NetBIOS information per port, draws graphs and allows you to change VLANs and enable/disable ports with logging.

http://www.netdisco.org/

Gotta use tools

[StarWreck]

With big jobs you have no choice but to use some highly specialized tools. It sounds like the Testum Network Management Tool would be useful.

It'll help you figure things out a lot easier. It also does a lot of other nifty things that could become useful when you need to expand the network.

Poorly

[Sycraft-fu]

Well, that's the truth for our orignization. You don't want ot know how we do it. What you should look at for that scale, is probably dynamic VLANs. Cisco has good solutions, I'm sure you can find vendor neutral ones as well, but I'm the kind of guy who will push a Cisco solution in general. At any rate the basic idea is that when soemthing gets connected it's MAC is checked and then a VLAN is assigned to the port based on it. So no matter where a computer is connected, it's in the same area network and security wise. This also means that unauthorized computers can be put in a nothing VLAN with no access.

It's not a magic bullet security wise, but it really makes management easy. You want all your engineers in a given VLAN, just assign their MACs to it. Then if one goes to a new office and nobody tells you, doesn't matter the hardware takes care of it for you.

Not an expert, but..

[WarlockD]

I would suggest, with that kind of load, something that has great Visualization software. I work at allot of different data centers and I can tell the ones that are organized are the ones where you can just glance at a screen to tell what's up and what's down. To find a computer by just typing its host name and it telling you exactly where the port is and where the current routes are. Even with the setup headaches, its all a one time deal with just a little maintance every time you change out a switch. Even then, with good config backups that downtime is eliminated.

Turn them All on

[Ada_Rules]

This is going to read like a troll..especially given all the IT support people out there...but oh well. Turn on all the freaking ports and get back to the support desk so someone is there when I call. I am so tired of the IT group doing huge make work projects in the name of security/scalabilty/Enterprise/CRM/blah blah blah. What a bunch of crap. You know us users out here... We really do have work to get done. I am sorry we are using the computers, storing files on the disks and want the Ethernet ports to actually work but we do. I really don't need to be down for 3 days when I need to move a computer to another desk to be closer to some new custom hardware I need to bring up. Who exactly do you think you are stopping from "getting at your network" with these toy approaches such as turning off the ports if no computer access it for a day or locking down by MAC address. These approaches are very good at stopping the actual users of the network from getting work done. They are a pathetic attempt at security for anyone that actually wants to do damage to the network.

Re:Turn them All on

[awol]

Amen. IT Hinderance would be a better description than IT Support in most of the places I have dealt with.

I would make one proviso. The "Production" Network should be physically isolated. Maybe VLAN would work but I still reckon that production networks belong on different wire and different routers etc. Rogue applications, even when not malicious, should not be able to flood the production network under any ciscumstance.

Re:Turn them All on

[swordgeek]

My choices here were to mod you down, or to reply. I'm chosing the high road, I think.

Your suggestion has merit--turn on the damned ports, let people plug in, and get work done. Lower admin overhead, faster response for the end user, and everyone can get on with their work.

However, you seem to have an attitude problem, and I suspect it takes three days to get you on the network because nobody really gives a shit if they get around to doing your bidding. Doing work for people who believe they know your job better than you do is about as much fun as slicing open veins, and rather less satisfying. MAC address-based port connections may not be the perfect security solution, but they are one powerful layer in a multi-tiered environment, and they're absolutely not a toy. Consider: People bring personal laptops to work, plug in to the LAN, and a virus spreads because the primary virus scanners are at the perimeter firewall. The ENTIRE FUCKING COMPANY is now down for between six and 72 hours. Oh, but that's OK because you didn't have to submit your laptop for scanning, and could start working immediately. Clearly your work is more important than anyone else's in the whole company.

Here's another scenario: A company has a mixed user environment of PCs and Unix workstations. We can declare that every port is enabled, but what ports are enabled on which network? What if the networks are split by division?

Contrary to what your fantasy world might suggest, IT is NOT there to block your progress! They want to get things up and running as fast as possible, and with as little overhead for themselves as feasible. Opening all ports in a moderately large company is neither feasible nor intelligent.

I think that you pretty much defined yourself as a legitimate troll (note: Not your post, but YOU) with this comment:

"I am so tired of the IT group doing huge make work projects in the name of security/scalabilty/Enterprise/CRM/blah blah blah. What a bunch of crap. You know us users out here... We really do have work to get done."

So you have real work to do, but they are a bunch of slackers inventing work because they have nothing better to do.

You, sir (or madam), are an asshole. I predict for you a long and frustrating career of nobody doing what you want, just for the sake of pissing you off. Good riddance.

Re:Turn them All on

[Anonymous Coward]

Heh.

Once you users adopted Windows, and invited the horror of constant attacks upon unwitting idiots such as yourself (which WE have to deal with), you lost all rights to complain.

You will obey the rules, and do ITs bidding; because 99% of what IT does, is clean up your messes. Upper management does not want to hear that today's profits are shot, or that they lost a major client, due to "the network being down". WE prevent that from happening, and you get to keep your job. Just imagine being the employee who cost the company a billion dollars, or put the company into bankruptcy.

It is not to protect the network from those who intend to harm it (that requires more subtle methods), it is to protect it from the idiots (i.e. You).

If it's inconvenient, deal with it.

You can learn to live with it; You can quit; Or you can clean up your act, behave like a responsible user, and make it unnecessary.

-e

Re:Turn them All on

[AmigaBen]

You, sir, are absolutely correct. I am saddened that I don't have mod points to counter the 'flamebait' someone modded you as.

Re:Turn them All on

[LabRat]

Clearly spoken by someone who has never had to work until 3am cleaning up a network that has been infected by some idiot saleman who thought bringing his personal laptop in from home was a good idea. Obviously anti-virus software goes a long ways..but in sudden outbreaks like Nimda, SQL slammer, and friends...day-zero exploits have to be stopped at the access level and that is only possible when reasonable access control is present along with solid use policies that folks actually adhere to. Sorry if you consider that "inconvenient"..but until YOU actually are the one who has to clean up the messes, I'd keep your holier-than-IT attitudes to yourself. Just a random thought...

Re:Turn them All on

[Anonymous Coward]

Something you may not be aware of - you know those little ports on the wall where you plug in your computer? They are not all connected into switches. Why? Do you think it makes sense to buy switch ports for every socket we have when we may have 2000 computers but 10000 sockets? That's why when you decide you want a new office and move without telling IT that it doesn't always work.

Also, there is not one all prevailing 'network' where if you are connected you are going to get service - we have things like VLANs and we have to connect you into one that is approriate. (No you can't 'just be in them all'.)

We also really, REALLY do not appreciate it when people who think they are clever bring in worm infested Windows laptops and connect them into our business network where the worms try to start spreading. 'So what' you say - you should patch. Yes well we do patch, but I've yet to see the workstation patch that will protect machines from a broadcast storm being caused by all those ARP queries as a handful of infected machines try to spread.

We'd love to spend more time making all this nice and easy for you users, perhaps even working on our wireless network meaning that you could bring in your own laptop and we could partition it off somewhere so you can use the web but not infect us, but often we are too busy reading error messages back to you when you call.

'Hey I have an error on my screen'

'What does it say?'

'It says 'wrong password'

'That means your password is wrong'

'Well why didn't it say that?'

Re:Turn them All on

[argoff]

Consider: People bring personal laptops to work, plug in to the LAN, and a virus spreads because the primary virus scanners are at the perimeter firewall. The ENTIRE FUCKING COMPANY is now down for between six and 72 hours. Oh, but that's OK because you didn't have to submit your laptop for scanning, and could start working immediately. Clearly your work is more important than anyone else's in the whole company.

Basically what you're saying is, "well we got poor end-point security, so we need massive centralized port control". But in all fairness, this is more of an argument for beefing up end point security than it is an arguemtnt for centralized control (and for ditching windows, but that's another topic all tigether). The guy in the parent post was probably legitimately fusterated, and really has a point. The internet is a multi billion node network with open ports, and it hums along inspite of all the issues. The internet scales and works because the intelligence is at the end-points and not the infrsatructure - the same is true with a large orginisation. Any effective security model needs to focus on the enpoints, otherwise the people in IT are going to be completely bogged down with with stupid authorization and access issues instead of on genuine problem solving and security. IMHO, you're better off saving all the extra resources for a bigger pipe then you are trying to control every port on the network.

Re:Turn them All on

[99BottlesOfBeerInMyF]

So you have real work to do, but they are a bunch of slackers inventing work because they have nothing better to do. You, sir (or madam), are an asshole.

You make some valid points (although I think I disagree that port management is a reasonable solution if there are serious usability tradeoffs) but I think you've gone a bit too far with the above. In large organizations such as the user is describing, it is often the case that the stated mission of a particular department does not actually have anything to do with the real goals of the people working there. I've seen my share of IT department projects that have nothing to do with meeting the goals of the company or serving the end users efficiently, but are designed solely to increase body count, keep the department budget high, or demonstrate importance. I've seen them with even more counterproductive goals as well like "make sure our infrastructure doesn't support macs any longer so we can expand our control into the marketing department that is administering themselves right now.

Further, your name calling is simply counterproductive. Are you sure you're not transferring your anger at someone where you work to the previous poster? He was right to say that the goal of the IT department "should be" to facilitate others getting work done. In truth, in many cases he is right.

Re:Turn them All on

[MrNaz]

Basically what you're saying is "protect the users machines because they are more important than the ones that control the services they rely on". The Internet hums along despite the issues? You've never heard of Melissa, Blaster or ILoveYou? And you're saying there is no intelligence in the infrastructure? So the global, load balanced, DNS system is a trivial part of the network and the Internet would be just fine if there was no security surrounding the root servers? The internet works because of the security at the endpoints you say. So large scale Windows virusses have never caused monetary loss at a company due to network-wide downtime?

Oh, and "fusterated"?

You obviously know nothing about IT security or how "fusterating" it is for IT admins to make things work for end users who only end up spitting in their faces accusing them of being lazy.

Re:Turn them All on

[crotherm]

I work for a rather large company where different types of traffic on the net are VLAN isolated. We have all the ports enabled. We also have a very mobile work force. People come and go all the time from site to site. We even have stations that are public offices where people from different sites can come in and use. They are always hot. We have had virus episodes, and we probably will again. But we also have very strict rules on laptops. We have very strict rules regarding software on all machines. We expect our users to be professional about their PCs. A per port security models would be cool, but if it took longer than a few hours to get these folks working, then that would be unacceptable cause sometimes these people only have a day or so to get something done.

I understand that this might not be a very common environment, but it is ours.

Re:Turn them All on

[geekoid]

Which is why virus protection should be on the machine.

Give each computer it's own preconfigured firewall.
As well as a copy of AVG.

your viruses that spread through the company will mostly begone.

Granted I deal with a small network 200, but the systems have never been all down at once. Ever.

Re:Turn them All on

[Anonymous Coward]

Heh. If I don't get moderated as flamebait now and then for making a legitimate and carefully-worded post, I'm clearly not putting enough effort into my arguments.

Re:Turn them All on

[jimicus]

Ignore them. That kind of answer shows up in every damn discussion about anything sysadmin related, and if you read between the lines what they usually mean is "I'm 14 years old and my school has taken measures to prevent me plugging my own laptop into the network! Boo!"

Re:Turn them All on

[dustoaction]

Just to let you know, unless you work in a pretty small company the guy who is worrying about ethernet management is not the same guy who is supposed to answer your phone and fix your computer, dude.

Re:Turn them All on

[Anonymous Coward]

Great idea. Until someone either clueless or malicious decides to bring a laptop from home into work.

How do you support vendors?

[bhmit1]

Luckily I haven't run into any clients that have gone to port level security, but I'm curious how well I'd be supported by those that have already setup such a system. For those that have already done this, how well do you support consultants and vendors that show up with their own laptops preloaded with all their own tools who need access to important servers? Do we have to wait for a network login (likely a domain account) and install some kind of app? What about the ones who's PCs are configured for another companies network and cannot be changed (e.g. we don't have Admin on our own laptop) or if we show up running Linux? Myself, I have root, but it's on linux. So, being independent, I'm wondering if I should include a clause in my contract to cover environments that lock me out.

Re:How do you support vendors?

[Fallen Kell]

We support them very well. We have specific ports in all buildings that are "vendor" ports. They are isolated on their own subnets/vlans and have very limited access to services (i.e. proxied connection to the internet, no connection at all to internal intra-net). As for tools to connect to servers, etc., well, the simple truth is, you don't get connection from that system. Viruses, backdoors, spy-ware, etc., are all too much of a security risk to allow any system of unknown configuration to touch your network.

For the ones who don't have admin on their system, well they can browse the internet and get their email since you do not need to be admin to change your proxies.

If the contractor system must be connected to one of our systems to run the diagnostic, we will do a direct connect using crossover cables to a network port on the system it is connecting to . If no free network ports are on the system, one of the used ones will be appropriated or a private network is setup for the connection to occur through.

Now if you are the contractor, and you show up running linux, well, it would be expected that you first know how to use it and will be able to make the configuration changes needed to connect. The other alternative is that you simply will not have network access from that system and will simply be relegated to using another asset to connect to the net and transfer the files using CD, DVD, or thumbdrive.

Re:How do you support vendors?

[Anonymous Coward]

If a vendor/consultant were to require access to secure systems, they would have to follow security procedure. Coddling weak vendors/consultants is not our job, keeping the network secure is. If they can't live with it, they don't get the contract. We are paying them large sums to do what they do, so they had better do it to specification. They can and will be replaced.

If for some reason, they cannot be replaced, then we will have failed. Monoculture of any form is a security breach, unilateral control can never be afforded to an anyone. Preventing things like that is why we have jobs.

-e

Re:Your Mom's Solution to Port Mgmt

[Schraegstrichpunkt]

AHAHAHA HAHA HAH

... is what I would be saying if I were 12-15 years old.

Huh?

[StarKruzr]

I don't get it. Your dad does this to your house?

Too much work...

[BengalsUF]

Layer 2 Security may make sense on certain segments, such as Internet edge or server switch blocks, but when it comes to user segments, don't even bother. Leave them all open and implement your security on a level that is more manageable than layer 2!

Bradford Campus Manager

[Anonymous Coward]

http://www.bradfordnetworks.com/

Posting anon as I don't care to link myself to them. I don't work for them...just use their product. Little quirky at times, but for the most part, it's a pretty solid product! I'd hate to go back to manual port management...it's bad enough doing it for 100 ports nowadays (we let CM manage ResNet ports and other non-critical ports).

Good maps and schematics...

[Fallen Kell]

Well, first thing you want to have are good site network layouts in a CAD program, preferably done in scale. Do not worry about every single wire (it is nice though at least for the pulls from the floor to the closet's patch panels) but get the major items, devices, and closet feeds.

As for what connects where, well, that needs to be part of your asset management system to be really effective. Some type of database which contains records for each class of object (like computers, servers, switches, routers, etc., which also has fields for location and network port connectivity. Obviously you would want a relational style database, with one to many relationships for network connectivity since you may have multiple network interfaces on different devices. Now the hard part, actually making this part of your processes. You need to have this updated, and really the best way is to make sure that people have to go through the process in order to get on the network. What this means is that you absolutely must use something like "port security". If regular people can move a system from one location to another and just disconnect one device and connect this one and it works, you will never be able to keep any tracking/management system up-to-date. It will be up-to-date for a whole 5 minutes after you do an inventory of that cube/office/location before someone somewhere decides that they are taking over the room down the hall because it is closer to the window, or is next to the exit...

I can't state that enough, you need to FORCE EVERYONE TO USE THE SYSTEM. If one person doesn't use it, then everything he/she does will be under the radar and not detected which makes having such a system pointless because it doesn't contain valid data, and you might as well have done "/dev/random > my_network_layout".

Re:Good maps and schematics...

[Anonymous Coward]

I work at a largish company (~60K employees) that is heavily computerized. I completely second the advice to make your management a *required* part of the process. Have a database and keep it up-to-the-minute up-to-date.

It causes you lots of work because you have to manage a LOT but then, guess what? It is manageable.

Do they go by MAC addresses? I don't believe so. But they manage IPs. They are only recently allowing DHCP but this is a place where pretty much any network element is managed (and it is nice).

With a spread-out situation like yours, managed everything (both process-wise and gear-wise) will really help you. Leverage the manageability, too.

Of course I'm not in the network group, so I may have gotten it all wrong ;-)

Re:Good maps and schematics...

[Miniluv]

You forgot that /dev/random blocks rather quickly. /dev/urandom would much more rapidly yield a file large enough to potentially contain his 700+ site network.

Also, the file should end in .vsd for easier opening by colleagues.

802.1x or NAC

[Anonymous Coward]

The ultimate solution is 802.1x. Unfortunately, that essentially ties one mac per port (the first MAC to associate authenticates the port) for Cisco. Nortel can do multiple MACs per port while authenticating each one. You can also go with a VLAN switching solution like Cisco's Secure Access, Bradford's Campus Manager, etc. Those run $100k+ per 10,000 ports. There are FOSS alternatives as well like NetPass

75k ports

[bockafer]

They are all on VLAN 1 aren't they?

Specialized VLAN Management

[borisborf]

When I was training for my CCNA, they were telling us that most people use static port-based VLAN membership these days for corporate networks because it reduces overhead. I, on the other hand, was a big proponent of dynamic VLANs because of the extra security added. All that would be needed is to hire a couple people that, when a new NIC or laptop comes into the company and passes through your department, they add the MAC address to the database and assign it a VLAN.

That way, your users are free to roam the corporate network while maintaining their workgroup association but even more importantly, MAC addresses that arent in the database (unauthorized NICs like someone bringing their access point from home or their lappy) immediately trigger the port to go into disable mode.

-BorisBorf (The Monty)

Re:Specialized VLAN Management

[bockafer]

And a vlan for every MAC == at least a /30 (unless I am missing something here). Even on an RFC1918 network this seems to be a waste especially if it is a large NAT'd network.

Re:Specialized VLAN Management

[borisborf]

No... Not a VLAN for every MAC. You have your VLANs and drop the new NIC into a bin for that VLAN.

No clear cut solution

[Reapman]

I work for a large organization (thousands of users of hundreds of sites) and manage about 2000 users worth myself. Without going into too much detail I dont think we found the magic bullet. CiscoWorks and Optivity (ESPECIALLY OPTIVITY) are frankly POS systems, at least in our situation. MAC Address is an option, but it's far from 100%, and requires pinpoint inventory of every device on / will be on / surplused (good look with the last one) equipment. Wireless is NOT an option, from both speed and security (although I like wireless, I can't say airwaves are as safe as a cable which would require a vampire tap to get into, not as easy as sitting in another office) in our organization. Besides I have zero say in the matter.

the one idea i DO like, is any "external" access points, such as those where external clients may wander, those are locked to specific mac ports. However I think the best would be an inventory system tied into user accounts, that can track both machines and users as they go about. Having an organization that supports best practices for inventory is absolute must. If you can't say for sure what hardware exists, it's impossible to deny access to illegitimate users. Of course an organization the size your talking that's easier said then done. Eliminate as much room for user error as possible for inventory is another suggestion, such as grabbing machine info automatically.
 
The problem I think is as much the tools, as is the people and the fact we're inheritently lazy. Sorry for not an answer, but that's my take on it. Good luck.

Re:No clear cut solution

[kalvyn]

We use 802.11a wireless where I work, and it is actually more secure than our wired network. (see newer post about specifics of our solution) The Wi-Fi network is first secured on Layer 2 using a shared secret and then being authorized by a central access server. It is then secured on layer 3 using WPA2. Our traffic on the wired network isn't encrypted at all, so I see that as less secure, as an eays MAC spoofing grants you access. On the wireless, connections between wireless devices is explicity denied, so you can't talk to your peers. We're looking to migrate to a standards compliant 802.11i solution, but we are currently using AirFortress for the layer 2 encryption. And if that isn't enough, there are wireless IDS/IPS devices that can actively deny service to unauthorized wireless devices using radio interference and other DoS methods.

Re:No clear cut solution

[Reapman]

I have no doubt that WiFi can be incredibly secure, and even in our case would work, but our security folks redefine paranoia to the point of stupid (for example, instead of going with VLAN, they forced us into seperate physical hardware units.... which at the router seperates the traffic on VLANs anyways grrr!)

with that said tho... even with all the security of Wireless, I think a hardened wired network will always be more secure then a hardened wireless network (simple differences of the Physical Layer imo), but a secured Wireless network is MUCH better then a mickeymouse wired one, and for 99.999999% of the world a properly built wireless network is probably good enough.

Re:Your Mom's Solution to Port Mgmt

[WilliamSChips]

Not even 12-15-year-olds find that funny. Only the OP finds that funny.

doesn't work.

[Anonymous Coward]

Tried that last month, actually. No-killy the computer.

802.1X attack

[swmccracken]

Actually, 802.1X (on wired ethernet) can be attacked - read this. Yes, it is on Microsoft.com, but nothing in the article is specific to Microsoft technologies.

Now, this is definitely a deliberate attack (not an innocuous vendor just plugging in their laptop to check their email) but it is possible.

(You insert a hub between a legit computer and a legit switch port. You connect your attacking computer to the same hub, configure your attacking computer to have the same MAC, wait for the legit computer to authenticate which opens the switch port and off you go, subject to some caveats as mentioned in the article.)

They recommend IPSec as it authenticates each packet. 802.1X on wireless is not subject to the same issues because there is a session that is maintained between the AP and the client.

Re:802.1X attack

[Anonymous Coward]

maybe enabling internet connection sharing on a
authenticated machine and connecting thru that should
by-pass "per port MAC checking". the connection sharing
computer, i think, strips the requesting computers MAC and
adds it's "allowed" own one and rewrites the packet once it
recieves a reply ???

i don' have to handle that many ports, but i agree with
posters before that a network has to work and even tho
some network guys just need the extra work and hassle, this
is not the way to do it.

on the border packet sniff... errr... inspection etc is better.
i LOVE "coconut" network: all hard on the outside and all
juicy and soft on the inside #ahref to that "discovered classified
alien info on gov websites"-guy

Incredibly Easy To Discover MAC Addresses

[patio11]

1) Visually inspect one known-good piece of equipment. At my organization, for reasons which are beyond me, they're printed on every laptop (along with my username and static IP address). They're also frequently printed on the physical network card. So if a computer is in a physically non-secure location (guest-accessible computer, laptop stolen, laptop taken in for repairs by Geek Squad instead of IT, laptop taken home, etc etc) thats a vulnerability.

2) Socially engineer a wireless mac address. Go to any location frequented by the workers at your target institution -- say, the cafe across the street during lunch hour. Open a wireless hotspot with a name like "Roadkill Cafe Wirless Network" and don't require any sort of authenticiation. Take mac addresses off the logs, then return to the target institution and try until you find one that works. (Hopefully they don't have their wireless addresses and their wired addresses be the same... but I've seen it done before, by lazy IT types).

3) Call and ask somebody. "*ring ring* Hiya, Suzy, this is Bob in IT. We're having some problem with the router covering your workgroup. Have you noticed any problems? No? Thats great. We put through some fixes on our end and I need to be sure that they took. Could you please hit your windows key and R at the same time? Type in command, hit enter. See a big black box? Type in "getmac". Yeah, I know, its funny to say Get Mac on a windows machine, those quirky programmers, what can I say. OK, could you read me the group of numbers and letters with the dashes in them that you see on the first line? OK, thats what I'm showing on this end too. Thanks Suzy, you're all set. If you have any problems you know who to call."

4) Sniff it out of the air (again with the wireless vulnerabilities).

5) If you can compromise any machine on the network "arp -a " gets you the MAC address of anybody you can see. I'm fairly certain you can accomplish this via ActiveX control (a quick Google found one), and also fairly certain you can not do it by Java applet.

Obviously, these are intended to tell you what you need to look out for securing your network, not for breaking into someone else's. Now if you'll excuse me I have to explain to a boss on why the whole "mac address printed on the laptop" is unwise.

Re:Incredibly Easy To Discover MAC Addresses

[Anonymous Coward]

But if MAC addresses are so easy to discover, then there's no point relying on them for security, and thus it doesn't really matter if it's printed on the laptop, now, does it?

Re:Incredibly Easy To Discover MAC Addresses

[macdaddy]

This is why you don't rely on simple implicit authorization (MAC) for granting network access but instead force your users to VPN deeper into the network to gain access to anything over the wireless network. This brings back authentication and once again gives you authorization controls on a per user basis. Frankly it doesn't matter if your WEP keys (yes, I'm kidding, but then again I'm also serious) are compromised because the VPN tunnel protects all the sensitive traffic. It's a slick solution.

ONA - Open Network Administrator

[jsellens]

You might want to check out ONA - Open Network Administrator from Bruce Campbell at U of Waterloo. And his paper from the LISA 2005 conference.
http://ona.uwaterloo.ca/

Re:Your sig

[Philip K Dickhead]

You are prolly correct. I am referring to conducting a secret government, maintaining a 'hidden in plain sight' coup, and directing the operations for the US half of 'a new Pearl Harbor'.

Plame is serious in that regard, but also a footnote on the real crime.

Universities

[deceased comrade]

Now i must confess that i dont manage huge networks, and im going out on a limb. At the two universities i've been to, both manage their ports and wireless together with either having a certificate on the computer (not sure which method that is) and also by doing temporary access with a user/pass combo tied to all the other services. Im not sure which technologies they're using but its entirely seamless and extremely easy since if you're supposed to be there you already have the id, and if you're always there it only takes a few minutes to get the certificate. This really dosent create a headache like another user was complaining about.

simple

[Keruo]

Use epoxy. Just mix the two compound and fill in un-used ports.
Great securitywise but kinda limits future expanding.

Re:simple

[regen]

I know that you're being funny, but ....

This actually would solve the problem. All somebody needs to do bring along a little four port hub and plug that into one of the existing valid ports and plug in what ever they want into small hub. Especially with 700+ location, it is highly unlikely that all of the existing ports are going to be check by security for unauthorized hubs.

You're probably going to say, epoxy in the existing cables as well. But then I would just cut the cable and crimp on new plugs.

Re:simple

[Intron]

OK, escalation, is it? Now I'm replacing all of my ethernet connections with armored cable epoxyed into the wall and the NIC.

Re:simple

[regen]

I'm assuming that you are also pressurizing the air in between the conducters and the armor jacket so that you can tell when I cut a small hole in your armor, right?

Re:simple

[Intron]

I see your small hole and raise you vibration sensors which will lock out the port when tripped.

Migration path: manual-scripted-RADIUS-802.1x

[kalvyn]

I just recently stopped working for a government agency and I was responsible for managing port security on about 6000 ports. Our current end-game solution is to use 802.1x, however due to certain regulations, our agency couldn't operate a CA, so we couldn't feasibly request a new certificate for each host everytime one completes an accreditation process. But we were implementing everything else until we could get there.

Our short term solution is to standup a RADIUS server and use it for port-security. This isn't quite as good as 802.1x, but provides the same level of scalability without going as much in-depth. You bascially have your switches (assuming they have this ability) check the radius server for allowed MACs. This works the same as the MAC ACLs, but is centrally managed. We haven't gotten that far yet either, as we didn't have a RADIUS server. (more stupid regulations that make that a headache)

So, the current process is to manually change the MAC address on each port on each switch. We initially turn on port-security on the switches, and for the newer ones (Cisco 3550/3560/3750) once we determine that all the users are on that need to be on, we drop all other ports into a dead-end VLAN that has no access. The remaining ports we drop into our data vlan (we also have dedicated vlans for voice, wireless, video, and infrastructure management). Once we've established that, we secure the MACs to the ports. All port security violations are logged to a syslog server and the switches are set to restrict access. This prevents useless work of re-opening ports when some user decides to plug-in their home machine to download the latest Linux ISOs or torrents. For further changes (i.e. when a new machine gets put on the network), a call is made to the helpdesk which routes the ticket to the networking team (that's me) and I unlock the port. We then have to notify the security team, which scans the machine for vulnerabilities and applies patches as needed. After that, it is managed by WSUS and SMS.

Now this sounds very tedious, but it isn't that difficult to manage. For the last 2 months, I managed all port security by myself, as well as down network links, some remote office firewalls, and new switch installs. Port security helpdesk tickets were typically closed within 2 hours of the request (assuming the helpdesk tells me about them). As a bonus, and because I'm lazy, I wrote some scripts for WSH that will connect to a switch, get a listing of all port-security information, compare it to DHCP leases on Windows servers, and output a table that shows which host is on which port. I also expanded this for use on WAN links where it will recursively access all switches at a site, stopping when it reaches a router and display the same information on a per-switch basis. A pretty handy report. Useful for telling you which hosts aren't using DHCP (so you can ensure they belong there). The only real requirements for this to work are that the switches use CDP on infrastructure links and they support ssh. You also have to have a CLI ssh client that supports putting the password on the command line (or certificate based auth if you can set that up, I don't think Cisco devices support it, although I think kerberos works :)

802.1X

[Anonymous Coward]

Thinking a bit more abstractly:
We're talking about limitation and control of L1/L2 network access, right?

When Wi-Fi came along, the same issue had to be solved. Part of 802.11i Wi-Fi security is use of IEEE 802.1X - a standard which was designed just for this purpose, even before wireless networks were around yet. So it's perfectly suited for wired networks as well. Use network equipment with Authenticator capabilities, install a Supplicant on your authorized clients, good to go.

that's just 100 ports per site

[cow-orker]

half of them probably not connected to any switch at a given time. Why do you need to complicate matters by "managing" ALL ports of ALL sites at once? What's there to manage anyway, you don't even have physical access to most of them!

Go back to basics, think about one subnet at a time. If you can't trust that no rogue machine will be connected to that net, don't run insecure protocols over it.

NetDisco

[Imbolc]

(Link goes to NetDisco.org).

If your network infrastructure supports SNMP pretty much all the way, this tool is pretty rad.

Physical security

[Kadin2048]

In this situation since we're talking about the security of physical internet ports, that an intruder can access them in person is sort of assumed.

If you have really good physical security (an intruder can't get to the Ethernet ports) then it sort of obviates this entire discussion -- why bother doing all the obnoxious port security if you can guarantee not letting anyone un-approved get access to an Ethernet port? You wouldn't. Except that you almost certainly can't guarantee that, hence why people are interested in such things.

So if you're even thinking about securing a wired network, it makes sense to assume that the theoretical attacker would have physical access at least to the endpoints of the infrastructure (the ports themselves, other client PCs) and could read the MAC address off of another client.

Re:Physical security

[Anonymous Coward]

We've never had a problem with an inturder, but guests hooking up infected machines is a non-stop problem. I'm just pointing out that there are many different goals in security.

Cisco clean access

[Jaiden]

Look into Cisco Clean Access and NAC appliance. I just got trained on that a couple weeks ago.

Systimax System Manager

[Anonymous Coward]

Disclaimer - I am a consultant that does software testing for the System Manager software and iPatch hardware.

You're question really has two parts, a) what policies are preferred for managing large networks and b) what is a good way to enforce that policy? I feel like the above comments cover some pretty good pros and cons of various policies, so I'll skip that in favor of the second question.

Having managed a few large networks in the past, I can honestly say I wish I had known about the iPatch System Manager software. The single greatest problem I had was keeping my knowledge of the state of the network up to date. With current knowledge of the network, implementing (or switching) policy is much easier. Anyway, the basic idea of the software is to help you gather and maintain as much information as possible about your network. Specifically, System Manager
--Allows manual inputting of network architecture from buildings down to desktop hubs
--SNMP features allow for in software management of switches (enable/disable ports, customizable snmp trap alerts, more)
--Integrates with HP Openview (I'm not a fan, but some people love it)
--Automatic service provision (if cabling is in place)

If you buy the iPatch hardware to go with the software, it can also
--Automatically discover and maintain rack architecture and panel patching state (including notification of unauthorized patches)
--Provide at-rack patching and job completion (which is then relayed back to the software)

IMHO, this software makes managing large networks much easier, regardless of the policies you use.

Multi-layer approach...

[ex1580]

Many great recommendations have already been made and i believe the answer isnt quite as simple as you would like.

First, on the size network you are working on it would be easier for you to have all of the ports plugged in and to use a method such as gateway device to control access if they all come through a central point (www.bradfordnetworks.com) as well as having decent access control to the buildings. For the physical access control, that is really only feasable in an area such as the server room or a similar smaller area that doesnt change as often. Many companies have the internet connections for their remote divisions as a WAN link through a corporate headquarters so they can manage it.

Secondly, you need to organize the network using VLANs and subnets in a way so that it is easy to control (hopefully this is already done). For example, division "abc" has subnet 172.17.100.XXX and division "def" has subnet 172.17.102.XXX ...etc. Once this is in place you can control the traffic at each division using VLANs so you can have more granular control over it. In this method you can do things like send all of the wireless traffic through a particular security device.

Thirdly (and this is the big one), you need excellent management of IT at your company. If the users know they can be fired for installing a program or going to the wrong websites it will keep them on track and using their computer to do their job and not their promote personal life.

Also, devices such as a proxy server that you can control where they go on the internet will help minimize risk by only allowing users to use their computer for their job. This as well as other devices that could detect a virus and "dead end" a user to a VLAN where they cant hurt anything (see www.bradfordnetworks.com again, although costly it really is a decent solution) are the type of investments that can save you down the road.

Best of luck to you.

network engineer's job

[Anonymous Coward]

it's easy. you don't manage ethernet ports. cisco catalyst 6500 switches or foundry bigiron are popular for large environments. switches run this thing called "spanning-tree" aka IEEE 802.1d (and improvements such as .1s and .1w). layer-3 switches can run other things such as IETF/Cisco HSRP, IETF VRRP, or Cisco GLBP, as well as connect to other layer-3 devices with something called IPv4 and routing protocols such as OSPF, ISIS, RIPv2, EIGRP, or BGP-4. once you've mastered those (or hired a network engineer), you can move on to actually building a large network.

i guess if you wanted to "manage" ethernet ports in the way that you describe, i would consider using IEEE 802.1x. you don't need any network management software or SNMP to do this.

MAC Address?

[xbmodder]

I have noticed that setting the switch's MAC address on the port works well. Basically being like only allow traffic from/to MAC addy XYZ.

Why do you need port based security anyway? Just secure your switch, keep it locked up...