MAC based VLAN

[NetworkGeezer]

Following on from the mutiple versus single domain thread, it is possible to create a dynamic VLAN which only routes traffic based MAC address?

[GeeDee]

....The point of this being what exactly? What are you imagining happening in this scenario?

[Ric_]

@GeeDee: I'm guessing that NetworkGeezer wants to make sure that the VLANs are correct no matter what switch port is used - for when the little darlings decide to swap patch cables.

[Geoff]

I suspect you can do this in combination with 802.1X, however you switches need to support it.

[GeeDee]

@GeeDee: I'm guessing that NetworkGeezer wants to make sure that the VLANs are correct no matter what switch port is used - for when the little darlings decide to swap patch cables.

Considering how easy it is to spoof a mac address (they even give you a nice field in the GUI with most driver sets these days) that's hardly going to bring you any security benefit.

If ensuring ports aren't swapped is a priority for you, just enable port security.

[spc-rocket]

I think this requires a kind of a server (for CISCO is VMPS - Vlan Policy Management Server) which basically keeps track of all mac addresses and that way it know which vlans to associate with which mac. This does give you the flexibility of just plugging a workstation or laptop in and not having to worry about assigning the correct vlan etc.

Downside of this is the cost obviously of purchasing the server side of things and also some security issues as well. My advise would be to stick with static vlans as you which ports have been assign which vlans etc. Its a bit more work but better control.

Ash.

[NetworkGeezer]

Yeah Ric's right, though an added requirement was to avoid tying-up ports or APs to one particular purpose. That way two different groups of users can use the same the infrastructure but be fenced off from each other.

As GeeDee has pointed out though, this idea belongs to Baldrick Network Solutions (TM).

Thanks for tip Ash. Might try it there is no other way of doing it.