IP Address restrictions by MAC
I have some users in my network. I have a Dual WAN in my network with a Policy Based Routing. All this is working fine and I get routed to the correct WAN. My question is can the ISA restrict/not allow/block users which have not been registered in my Address Groups by MAC.
Currently I have a DHCP Pool which is routed to use WAN1. My laptop which is static and registered by MAC in Address Objects will use WAN2. The routings are working good. How can block unauthorized hitchikers from using the WAN2, e.g. taking my static IP. If I could remember the Cisco RV042 has this feature in the DHCP tab. To "Block IP Address with the wrong MAC Address" and "Block unregiestered MAC Adress"
DHCP pool: 192.168.100.1 - 192.168.100.200
As an extra, I have "Web URL Filtering" enabled. Is it also possible to create some exceptions for the Static IP Users.
Dan,
There are a couple ways to approach this. The simpliest way to deal with the DHCP/MAC issue is to create Address Objects in Address Management for each of the Static devices based on their MAC address instead of IP. Then create an Address Group that contains all those MAC Address Objects. Finally apply an Access Rule to the WAN2 interface to allow traffic destine to that MAC Address Group and deny all other.
The second way, taking into consideration your question on Web URL Filtering for those Static users. Regarding the use of Web URL Filtering and Application Control, I would recommend reading these posts by myself and Ciscomax.
https://supportforums.cisco.com/message/3955016#3955016
https://supportforums.cisco.com/message/3956460#3956460
Short answer is that Web URL Filtering must be applied by Zone and only one policy can be applied to a Zone. So you could create another Zone and VLAN, one for your DHCP users and one for your Static users. Then apply you desired profiles to the respective Zone. If you go this direction, you could also use the same method I outlined above to control WAN 2 access by MAC, but you could apply it to that new VLAN interface as the source instead of the WAN2 interface as the destination.
I hope this helps. If you have additional questions, please don't hesitate to ask.
Similar Messages
-
Domain authentication with mac address restrictions
I am in a branch office and I have one WLC 5508 and one ACS 4.2 with three WLANs:
WLAN1 with SSID1: for company computers and laptops
WLAN2 with SSID2: for ipads and tablets
WLAN3 with SSID3: for guests
I am asked to configure WLAN2 as “WLAN2: Provides the Wi-Fi connectivity to ipads and tablets, with back end security using domain authentication with mac address restrictions.You would need to create a seperate policy and be able to have a seperation between the two policies... It's kind of hard to explain, but you would have for example:
Policy 1:
Wireless user on this SSID WLAN1
AD on this AD Group (Machine)
Policy 2:
Wireless user on this SSID WLAN 2
AD on this AD Group (USer)
Thanks,
Scott
*****Help out other by using the rating system and marking answered questions as "Answered"***** -
Port-security MAC address restrictions and flexconnect
Hi - has anyone else seen this issue?
We use port-security on flexconnect ports limiting the maximum mac addresses to 100. The ports are configured so that the native vlan is the AP management vlan and we tag the wireless client vlan.
Recently we had an issue where we were seeing MAC address restriction violations on the ports connected to AP's. Although we could not see the violations happen in realtime they were in the switch logs. In Cisco Prime we checked the client counts on the AP's and they were less than 10 at that time the error occurred.
We then increased the max mac addresses to 200 and still saw the same issue. Removing port-security seemed to fix the problem.
This was the model and version of the switches.
WS-C2960X-24PS-L 15.0(2)EX4 C2960X-UNIVERSALK9-M
Has anyone else had this?
Any help much appreciated.Hi - has anyone else seen this issue?
We use port-security on flexconnect ports limiting the maximum mac addresses to 100. The ports are configured so that the native vlan is the AP management vlan and we tag the wireless client vlan.
Recently we had an issue where we were seeing MAC address restriction violations on the ports connected to AP's. Although we could not see the violations happen in realtime they were in the switch logs. In Cisco Prime we checked the client counts on the AP's and they were less than 10 at that time the error occurred.
We then increased the max mac addresses to 200 and still saw the same issue. Removing port-security seemed to fix the problem.
This was the model and version of the switches.
WS-C2960X-24PS-L 15.0(2)EX4 C2960X-UNIVERSALK9-M
Has anyone else had this?
Any help much appreciated. -
Hi all,
Is there any restriction on Mac OS X 10.6/10.7 that binaries running from root directories like /usr/libexec/ cannot load dylib's at run-time using dlopen() or NSAddImage()?
I am trying to run a binary like "sample" from a directory inside /usr/libexec/ which tries to load a dylib like "sample.dylib" which is present in the same directory as "sample".
It resulted in a segmentation fault with the following error and stack-trace.
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000003430
0x0000000000003430 in ?? ()
Using gdb, I could find out that the program crashed inside dlopen() (the path passed to dlopen() being a simple filename like "sample.dylib").
The dlopen() at the top of the stack-trace pasted below gets called around 10 times; it does not crash during this 2nd level dlopen() any-time.
#0 0x00007fff81be9e93 in dlopen ()
#1 0x00007fff82838f7f in map_images_nolock ()
#2 0x00007fff82821bc0 in map_images ()
#3 0x00007fff5fc039b9 in __dyld__ZN4dyldL18notifyBatchPartialE17dyld_image_statesbPFPKcS0_jPK15dyld_imag e_infoE ()
#4 0x00007fff5fc0c839 in __dyld__ZN11ImageLoader4linkERKNS_11LinkContextEbbRKNS_10RPathChainE ()
#5 0x00007fff5fc04d48 in __dyld__ZN4dyld4linkEP11ImageLoaderbRKNS0_10RPathChainE ()
#6 0x00007fff5fc08f68 in __dyld_dlopen ()
#7 0x00007fff81be9ec0 in dlopen ()
#8 0x000000010002694f in AAA ()
#9 0x0000000100026730 in XXX ()
#10 0x0000000100026494 in YYY ()
#15 0x00000001000566a9 in main (argc=7, argv=0x7fff5fbff810) at ../../main.c:50
After this 2nd level dlopen() gets called 10-15 times, the stack will unwind from map_images_nolock () till __dyld_dlopen (). But when it tries to finish all the instructions inside __dyld_dlopen () and step out of it, the program crashes with the EXC_BAD_ACCESS signal.
Please find below the final stack-traces obtained during debugging when I put breakpoints for AAA() and dlopen() and went on stepping inside till the program crashed.
(gdb) bt
#0 0x00007fff5fc04d48 in __dyld__ZN4dyld4linkEP11ImageLoaderbRKNS0_10RPathChainE ()
#1 0x00007fff5fc08f68 in __dyld_dlopen ()
#2 0x00007fff81be9ec0 in dlopen ()
#3 0x000000010002694f in AAA ()
#4 0x0000000100026730 in XXX ()
#5 0x000000010002663c in YYY ()
#11 0x00000001000566a9 in main (argc=7, argv=0x7fff5fbff7f0) at main.c:50
(gdb) step
Single stepping until exit from function __dyld__ZN4dyld4linkEP11ImageLoaderbRKNS0_10RPathChainE,
which has no line number information.
0x00007fff5fc08f68 in __dyld_dlopen ()
(gdb) bt
#0 0x00007fff5fc08f68 in __dyld_dlopen ()
#1 0x00007fff81be9ec0 in dlopen ()
#2 0x000000010002694f in AAA ()
#3 0x0000000100026730 in XXX ()
#4 0x000000010002663c in YYY ()
#10 0x00000001000566a9 in main (argc=7, argv=0x7fff5fbff7f0) at ../../main.c:50
(gdb) step
Single stepping until exit from function __dyld_dlopen,
which has no line number information.
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000003430
0x0000000000003430 in ?? ()
To summarise:
For some reason, a user wants to install a product and its binaries under /usr/libexec/.
This binary tries to dynamically load a dylib using dlopen("sample.dylib", RTLD_LAZY | RTLD_LOCAL).
It looks like, the dynamic linker then opens dependent dylibs and runs module initialisers. Then crashes when returning (which sounds like a trashed stack).
Can anyone please tell me whether there is some OS-imposed restriction or OS bug which can explain this type of behaviour?
(Note: The crash does not occur if the binary and dylib are installed under a normal user's home directory and run from there.)
Many thanks,
VinayThe otool output for the binary and dylib are pasted below.
localhost:Latest dev$ otool -L /usr/libexec/Dipu/sample/sample
/usr/libexec/Dipu/sample/sample:
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 476.18.0)
/usr/lib/libstdc++.6.dylib (compatibility version 7.0.0, current version 7.4.0)
/usr/lib/libgcc_s.1.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 111.1.4)
localhost:Latest dev$ otool -L /usr/libexec/Dipu/sample/sample.dylib
/usr/libexec/Dipu/sample/sample.dylib:
libProduct.dylib (compatibility version 1.0.0, current version 1.0.0)
/System/Library/Frameworks/Carbon.framework/Versions/A/Carbon (compatibility version 2.0.0, current version 136.0.0)
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (compatibility version 1.0.0, current version 275.0.0)
/usr/lib/libstdc++.6.dylib (compatibility version 7.0.0, current version 7.4.0)
/usr/lib/libgcc_s.1.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 111.1.4)
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 476.18.0) -
HT1637 How can i change my email address on my mac to my new email as my other one has been hacked
How can i change my email address on my mac book air email that has already been on the mac book air to my new email as my old email address has been hacked and it will not let me change it
Call the tech support for the provider of your old email. They will be able to change the password for you or if they can't they will shut the account down so that spammer is not able to use it.
Allan -
HT2500 can i have multiple e-mail addresses with one mac account
Can i set up multiple e-mail addresses on one mac account
You can have as many as you want. Add an account with Mail Preferences > Accounts. Click the "+" button.
-
My Mac has been stolen, but I have my iCloud account setup. The "find my mac" app has found the apartment block it's in, but I need an IP address for the police to go and claim it. Is there a way to see the IP address of my Mac through iCloud? I've tried to get the IP address through Gmail and Dropbox but no success. Is there any software that updates automatically that I could find the IP address through?
Shouldn't the IP address be on the box you bought the machine in? If you have the box, take it to the police as evidence that it's your machine. If I were you, I would set the firmware password when you get it back, but make sure you have the password written down in a safe place. If you forget it, there's only two ways to reset it. Either pay $400+ for the tool that can do it, or pay almost nothing for Apple to do it, I think it depends on where you live. The firmware password is this encrypted password and it can't be hacked either. The password prevents anyone from booting the machine into recovery mode, thus preventing them from restoring the computer to factory settings or performing any other functions. It's not stored in the hard drive so replacing that will be of no use either.
I hope you get your Mac back and I hope this was helpful! -
How do I move/copy contacts from Entourage to iCloud Address Book without creating duplicates? Address Book on Mac, iCloud, iPhone and iPad is now empty
Thank you for letting me know!
Going to give it a go. Had a back up of all my clients files stupidly not my software as I have the originals disks. Just realised that amongst the software is ibiz and have lost al my accounting and billing files for the last 7 years want to cry so losing my contacts now will really tip me over the edge!
Fingerscrossed this works! -
IP address restrictions not working with bea weblogic plugin
We want to implement IP address restrictions via the Sun Java One Web Server admin tool for our application. We are using the Sun Java One Web Server to proxy requests via the Bea Weblogic plugin. However, we cannot get IP address restrictions to work because of the leading asterisk in the following NSAPI entry for PPATH of obj.conf :
<Object name="weblogic" ppath="*/cmcsr/*"> Service fn="wl_proxy" WebLogicCluster="10.156.20.11:9010,\
10.156.20.12:9010,10.156.20.13:9010" DynamicServerList="OFF"
</Object>
Has anyone gotten IP restrictions to work with the bea Weblogic NSAPI plugin?I'm not sure what you're asking, but each Service directive should be on its own line. It is an error to have both a <Client> tag and Service directive on a single line.
-
HT2486 HOw do I transfer contact numbers and email address from my Mac to my new iphone?
How do I transfer contact numbers and email address from my Mac to my new iphone?
Connect your iPhone 4S to your Mac using the iPhone’s USB cable, and then use iTunes to transfer your contacts from to the iPhone. (An alternate way is to use iCloud.)
I’m not sure what you mean by “transferring email address” from the Mac to the iPhone. But if you mean you want to access your email from the Mac and the iPhone, the best way is to configure your email account over IMAP in Mail on both devices. -
I created 2 Gmail addresses. My Mac recognizes and accept only one name in the System Preferences.
When I send a mail with one of the address, the recipient receives it with this address, however, if he replies, the incoming address will be the second one? ? ?I've never had a problem with multiple email addresses. My ISP's email account has multiple accounts and the same SMTP server, no problem.
I can't speak for GMail as I only have one, and that is my spam email account, so I don't really care what it sends.
I really don't understand your response.
What was "reviewed" and what was "ok" about it?
Their suggestion was to open a different session for each Gmail account.
"Different session." What does that mean?
Gmail is a very bizarre email server. It was designed to be web-based, but due to demand, they made it pseudo-compatible with POP and IMAP.
If you move email out of the Inbox, Mail will reply using the "default" email account, not necessarily the one that was originally associated with the message. Being that Gmail doesn't really have mailboxes or folders, but has tags it calls "Labels," it may have something to do with that issue. -
How export yahoo address book to mac mail?
how export yahoo address book to mac mail address book?
thxThis is really a question better asked to Yahoo support but...
Go to the Addresses tab of Yahoo and click on the 'Import/Export' link
Click the Export Now button for vCard Single File, then when it downloads double click it to import into AddressBook. -
Can't open address book on mac os x
try to add new address information to my address book on mac mini,
no response when open the address book.
has updated the combo Mac OS to V10.5 but the problem still exist.
or is a way to reinstall the address book?
please help!
Message was edited by: address bookWelcome to Discussions!
In Finder, click Go>Home, open "Library", open "Preferences", find the files com.apple.AddressBook.abd.plist and com.apple.AddressBook.plist and move them to your desktop.
Then log out and log in again, and try again.
Good luck!
Message was edited by: joshz -
I have Outlook 2011 installed on my Mac Pro, but I can not install it icloud. I can only get through imail, iCal and Address Book in Mac native anyone know teach me how to work with Outlook 2011 icloud? thank you
"iCloud requires iOS 5 on iPhone 3GS or later, iPod touch (3rd and 4th generation), iPad, or iPad 2; a Mac computer with OS X Lion; or a PC with Windows Vista or Windows 7 (Outlook 2007 or 2010 or an up-to-date browser is required for accessing email, contacts, and calendars). Some features require a Wi-Fi connection. Some features are not available in all countries. Access to some services is limited to 10 devices."
From here > http://www.apple.com/icloud/ -
How to Import Outlook Address Book into Mac Address Book?
I will be making an employment change and need to import my pc Outlook addresses into my mac email addresses. After repeated emails to Apple and apple support phone calles no one can help because I am not going from a mac to a mac. Unbelieveable. Actually it's not-the lack of customer services these days should not surprise me.
Anyway, anyone know how to do to save me having to re-type hundreds of addresses?
Thanx!
Powerbook G4 Mac OS X (10.4.6)You need to export your Outlook contacts into a VCard format.
There are many programs out there that will do this for bulk jobs. But, you can do it for free if you are willing to do it manually.
Select each contact one at a time from Outlook. Then, go up to the menus (I think it's the file menu) and choose export, then choose to export it as a VCard.
I'm not in front of a PC. But, I remember doing it that way for about 80 something cards when I moved from my PC.
Once you have them in a VCard format, you can just drag and drop them into Apple's Address Book.
It takes some time to do it this way if you have a ton of contacts. But, it does work.
I think the PC format might be VCF but it is VCard.
Apple uses a different format of VCard than Microsoft does. So, you won't be able to use Microsoft's Export to export all the cards at one time.
That method will not allow you to import them into Apple's address book since they are different formats.
But, it will work if you export each individual record one at a time, and then drag each one into Apple's Address Book.
Additionally, if you find a web-mail service like GMail or Yahoo, or something like that that can synchronize with both the PC and the Mac, then you could try moving it to one of those services and then to Apple's address book.
For an automated system, check out:
http://www.littlemachines.com/
You can also read Apple's document on the subject here:
http://docs.info.apple.com/article.html?path=AddressBook/4.0/en/ad808.html
Hope this helps.
Maybe you are looking for
-
How do I use ZLIB in LabWindows?
I downloaded the ZLIB 1.2.5 DLL from zlib.net and I am trying to use it with a C program for LabWindows 8.5. I copied the DLL into my windows\system32 folder and the .h/.lib files into my project. When I try to build my code, I get an error that sy
-
Ezvpn client on router to windows vpn server
Hi is it possible to connect cisco router using ezvpn to windows 2008r2 server? i spend a lot of time and got no success. i'm trying to connect cisco 881g using ezvpn to windows vpn server (RRAS) usign pre-shared key. or i should try to connect in an
-
ITunes starts up whenever I connect my bluetooth headset
I am using bluetooth headset to communicate on Skype. Whenever somebody's calling me, I turn my headset on and it will automatically connect to my MacBook. Every time, however, it will also automatically start iTunes and begins to play. I don't want
-
Hi Experts, I've a module pool program 'SAPZPS01' in SAP 4.7. It's naming convention seems to be different from the common naming convention used. I want to create this program in ECC 6.0 but it's asking for Object access key... Any help is app
-
I spend lots of time staring at LP7...Glossy or Matte Screen??
Hey everybody. OK, I know this isn't exactly a LP7 forum issue so much as it is a MacBook forum issue bought thought it applies to all of us who are investing and have invested in the new intel technology provided by Apple. Glossy or matte screen? Th