Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 27 subscribers
  • Views 3758 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Physical Port Security

Ruben MEJIA

I want to be able to lock down physical ports on an XG85W and only grant access to specific MAC addresses.  I know how to do this to an SSID, but not on a physical port.  Can someone point me in the right direction, please?



This thread was automatically locked due to age.
Parents
  • 0

    Hi Ruben,

    if you haven't enabled the ports then they are locked, connecting to them will not get you access to anything.

    You can limit access by adding MAC addresses in each firewall rule, messy with many rules and users.

    Ian

  • 0 in reply to rfcat_vk

    Thanks for the quick reply, rfcat_vk!  I will have a device that will be connected to the port that I have enabled, but I want to prevent anyone from unplugging that device and plugging in another.  I have been able to specify on other firewalls (Cisco) a MAC address that is only allowed to access that port while all others are denied.  Is this possible?

Reply
  • 0 in reply to rfcat_vk

    Thanks for the quick reply, rfcat_vk!  I will have a device that will be connected to the port that I have enabled, but I want to prevent anyone from unplugging that device and plugging in another.  I have been able to specify on other firewalls (Cisco) a MAC address that is only allowed to access that port while all others are denied.  Is this possible?

Children
  • +1 in reply to Ruben MEJIA

    Hi Ruben,

    as this port will have its own IP address range and will not be using DHCP you will need specific firewall rules to allow the device to access networks. You can limit access in the firewall rules to 1 MAC address.

    Of course if someone is smart enough to unplug a device then there is a change they are smart enough to spoof your MAC address, but if you haven't advertised the IP address of the device they will not get connected.

    Ian