Security

last person joined: 12 hours ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Endpoint database against MAC spoofing

Jump to Best Answer
  • 1.  Endpoint database against MAC spoofing

    Posted Aug 06, 2013 09:21 AM

    before i start building it id check if someone knows this for sure. the problem with MAC authentication is MAC spoofing. does the Endpoint database help here? i mean what happens when i login with a two devices with the same MAC but with clearly different OSes (Linux / Win / Mac) do two different end points end up in the database, or does one overwrite the other?



  • 2.  RE: Endpoint database against MAC spoofing
    Best Answer

    Posted Aug 06, 2013 09:43 AM

    Yes!!!  We create a conflict condition if say a HP Printer (originally profiled) starts showing up as a Debian Linux device.  We can catch this and flag it as a "conflict" and based on that state you can trigger a deny or CoA termination to the network.



  • 3.  RE: Endpoint database against MAC spoofing

    Posted Aug 06, 2013 10:10 AM

    that sounds quite good, does that mean it stays one entry with an extra flag or do multiple MAC entries get created?



  • 4.  RE: Endpoint database against MAC spoofing
    Best Answer

    Posted Aug 06, 2013 10:16 AM
    It uses one entry


  • 5.  RE: Endpoint database against MAC spoofing

    Posted Nov 13, 2013 09:58 AM

    So in the latest CPPM 6.2.3.57998, "conflict" has been removed. Is there an ETA when it will be re-added?



  • 6.  RE: Endpoint database against MAC spoofing

    Posted Feb 26, 2014 03:05 PM

    hadnt even noticed, been working on getting mac spoof detection working for months now, no luck. personally im starting to feel it doesnt work (anymore) and there doesnt appear to be any interest in getting it to work.

     

    of course it is nothing more then a nice gimmick, even if the functionality would work in clearpass there are too many ways to bypass it.



  • 7.  RE: Endpoint database against MAC spoofing

    Posted Sep 15, 2014 02:11 PM