Port security

[mohammedalrawiib]

Dears 

our CTO wants the whole company mac address to be added in a port security so that nobody outside the company can access our network, is there any alternative solution for adding all the mac addresses manually.

[MHM Cisco World · Accepted solution]

the solution is MAB 

adding MAC is not prevent other MAC from ADD
adding MAC in port security will force only these MAC to use specific port

solution is MAB if the MAC not found in radius the access is deny 

MHM 

[MHM Cisco World]

There  command to disable MAC learn under vlan' but I never test before' I will try it in my lab abd update you.

Thanks 

MHM

[mohammedalrawiib]

I would really appreciate it 

waiting for your feedback

[mohammedalrawiib]

Thank you 

[Leo Laohoo]

Randomize MAC address is going to wreck that plan.

[Marvin Rhoads]

Network access control (NAC) is the general term for such measures. Cisco's product that does this is Identity Services Engine (ISE).

[Marius Gunnerud]

Port-security is not a good solution for what you / your CTO wants to do,  I would suggest looking into using ISE and 802.1x.  A much better and scaleable solution.