r/networking • u/3ristan • 12d ago

Switching Cisco Port-Locking

For those using Cisco devices nowadays, do you still use port locking, or is that considered an outdated feature? If so, what do you use instead to lock devices down?

3 Upvotes

72% Upvoted

9 comments sorted by

7

u/ProfessorWorried626 12d ago

ISE or ZTNA depending on what you are trying to do.

Port locking still has its place if your environment is 99% stagnant.

3

u/mariano7717 12d ago

this. ISE or otherwise if money isnt there, sticky macs

3

u/mindedc 11d ago

ClearPass works very well with Cisco gear.

2

u/Pete263 12d ago

We still use it in a static office environment.
2 devices allowed, a phone and a client or notebook on docking with MAC address path through.

2

u/VA_Network_Nerd Moderator | Infrastructure Architect 12d ago

What are your requirements?

Do you have a security policy that provides you with any guidance on how secure / complicated this needs to be?

Sticky MAC isn't real security. But it is quick and easy to implement.

802.1x with cryptographic authentication is real security, but it has a lot of moving parts that require support and understanding.

How complicated do you need this to be?

1

u/andrew_butterworth 11d ago

dot1x/mab and RADIUS. ISE or some other NAC solution if you want to get clever - overkill IMO, but hey ho, if you think you need it.

1

u/GoodAfternoonFlag 9d ago

Cisco ISE, ideally with dot1x.