Limiting network access by MAC address and what else?

Question

How can I limit the network access to a physical network from outside computers being plugged in? I know MAC filtering is one way, VPN is another - but it's not going to be used, so what else?

Answer 1

MAC filtering only works for people who don't know how to sniff the network for a valid MAC and spoof it; so almost no security at all.

802.1x works pretty well if your switches support it and you setup the infrastructure for it.

Answer 2

if your physical network is using a CISCO router or switch you can use the Port Security feature to fulfill your task. But the underlying feature will still be filtering based on MAC addresses.

Answer 3

If you're in a windows environment you can look into NAP (Network Access Protection).

Answer 4

Trunked VLANs or a lack of a default gateway to some of the machines along with segmentation of the network will put a definite crimp in the ability of machines to communicate effectively.

No GW no communication across networks boundaries....VLANs, with trunks....you can only allow certain vlans which will segment and not allow traffic on some links....there are alot of options. Good luck!