Wired Intelligent Edge

 View Only
last person joined: 2 days ago 

Bring performance and reliability to your network with the HPE Aruba Networking Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of your switching devices, and find ways to improve security across your network to bring together a mobile-first solution
Back to discussions
Expand all | Collapse all

How to prevent users from using layer 1 switches on network

This thread has been viewed 18 times

  • 1.  How to prevent users from using layer 1 switches on network

    Posted Feb 15, 2021 03:36 AM
    Hello,

    how can i prevent users from using layer 1 switches like (D-Link,Toto link) on aruba 2930M switches
    i uses commands ( admin edge ports and bpdu protection ) on ports but it didn't work, is there any other way?

    ------------------------------
    Ahmed Elshindidy
    ------------------------------


  • 2.  RE: How to prevent users from using layer 1 switches on network

    MVP GURU
    Posted Feb 15, 2021 08:46 AM
    Unless the switches are running spanning tree and sending BPDUs, your traditional detection will not work. You could look into limiting mac address on an edge port starting with port security ( https://techhub.hpe.com/eginfolib/networking/docs/switches/WB/15-18/5998-8152_wb_2920_asg/content/ch14s02.html )


    ------------------------------
    Dustin Burns
    ------------------------------

    Original Message


  • 3.  RE: How to prevent users from using layer 1 switches on network

    Posted Feb 15, 2021 10:28 AM
    Hello Ahmed,

    As Dustin already suggested we use port-security for the exact same reason to prevent users from connecting their own switches. We use the config as shown below by default. This limits the number of simultaneous MAC-addresses per port to 1, learning the 1st MAC-address that connects and blocks any others.

    ArubaOS-switch(config)# port-security <EDGE_PORT_LIST> learn-mode limited-continuous action send-alarm
ArubaOS-switch(config)# no port-security <ALL_PORT_LIST> eavesdrop-prevention​

    Note that users can still connect their own switches, but as soon as they use 2 devices at the same time on their switch the 2nd device's MAC-address will be blocked, thus it can't access the network. Eventually users will end up at our IT Servicedesk so we can remove their switch and place our own or patch an extra port for the user to solve their problem.

    Another note that a MAC-address limit of 1 might block users running VM's, or some VoIP solutions (when their PC is linked via their VoIP). In that case we up the MAC-address limit to the number needed for the user by adding the config like below.

    ArubaOS-switch(config)# port-security <EDGE_PORT> address-limit <NUMBER_OF_SIMULTANEOUS_MAC-ADDRESSES>
​


    Kind regards,
    Niels Mejan,
    University of Twente

    ------------------------------
    Niels Mejan
    ------------------------------

    Original Message


  • 4.  RE: How to prevent users from using layer 1 switches on network

    Posted Feb 15, 2021 12:39 PM
    Hello,
    Use bpdu  protection  on acces port to avoid switch connection and loop issues by the ways. 
    Disabled  all other unused port and use dhcp  snooping. 
    Max




    Original Message