We enabled portfast on dorm ports for the game consoles.
Ronald King Security Engineer Norfolk State University Marie V. McDemmond Center for Applied Research Suite 401 700 Park Ave. Norfolk, Virginia 23504 Phone: 757-823-3918 Fax: 757-823-2128 Email: [email protected]<mailto:[email protected]> http://security.nsu.edu From: Cisco Clean Access Users and Administrators [mailto:[email protected]] On Behalf Of Kyle Torkelson Sent: Thursday, January 13, 2011 4:26 PM To: [email protected] Subject: Re: 80 New Tablets One question, off topic, that I have is for those that have Cisco switches, are you using spanning tree? We have some gaming consoles in our dorms that students complain about not being able to connect and getting an MTU error. I've actually tested this and if I turn on spanning-tree portfast, the game consoles work right away. With out that command, the students aren't patient enough to get an IP and try to push the issue and then are unable to get connected since then they disconnect the ethernet cable, etc. Just curious if others see the same thing or if they push their gamers to use wireless. We'll be deploying Cisco 1142's in our dorms this Spring which I'm hoping will alleviate some of this... Thanks [cid:[email protected]]<mailto:[email protected]> From: Cisco Clean Access Users and Administrators [mailto:[email protected]] On Behalf Of Biddle, Rob Sent: Thursday, January 13, 2011 3:12 PM To: [email protected] Subject: Re: 80 New Tablets As long as the device has a browser there shouldn't be any reason to outright white list (as in allowing the device via a MAC address filter). I avoid MAC filtering whenever possible since it's so easy to spoof. NAC makes it fairly simple to setup different access based on OS detection. We don't currently require Apple (Although we do offer the OS X agent as an option) or Linux users to use the NAC agent, but we do require authentication via the NAC web login. iPad/iPhone/iPod Touch/Android devices all login via the web login. Most of the new tablets will be Android based, plus some Windows and WebOS. I don't see why any of those will be an issue. We do use specific MAC filtering for our Gaming network since the Game Consoles won't launch a browser until after they have successfully connected to Xbox Live/Playstaytion Network. I'm sure it wouldn't be too difficult to allow that traffic in the unauthenticated role, but I haven't had time to test it. We have a formal registration process for users requesting this type of access. I won't consider doing MAC wildcard white listing since that would make it extremely easy to spoof your way past NAC. _____________________________ Rob Biddle Network Systems Engineer / Administrator College of Mount St. Joseph From: Cisco Clean Access Users and Administrators [mailto:[email protected]] On Behalf Of Chris Zeigler Sent: Thursday, January 13, 2011 12:27 PM To: [email protected] Subject: 80 New Tablets CES was saying 80 new tablets should be out this year alone. As it stands at this time on our campus, we're simply whitelisting any students that come in with iPads and iPhones, but we haven't really seen any other devices. I'm curious to know what everybody else will be doing for tablets, gaming systems, etc. Chris Zeigler System Administrator Mary Baldwin College Staunton, VA 24401 540-887-7362 [email protected]<mailto:[email protected]>
<<inline: image001.jpg>>
