I was asked to look at hardware for mounting a phone near the loading dock at work. We have plenty of Cisco 7911s. The concern is someone plugging into the phone's pass-through NIC.

Is it enough to

  • enable MAC port security on the Cisco interface for that port such that the only device allowed is the phone, and disable it if someone plugs something else into it

  • physically damage the RJ45 connection where someone could plug a computer into the PC connection of the pass-through NIC

  • disable phone's screen so someone can't browse the company directory

I think these measures are sufficient, but is there anything else I can do to protect my network from outside access on this exposed phone?


There are weaknesses to your proposed solution that many network administrators would be able to subvert.

The obvious weaknesses are that MAC addresses can be cloned and the switch would be none the wiser. In fact, I could probably build a cheap device to clone the MAC address, allow the phone to continue to work AND allow me to plug in other devices.

If I were trying to do this I would set up a separate VLAN and put this phone on that VLAN - giving it access to only talk to the devices it needs to talk to. (It is theoretically possible to break VLAN security, but its a whole different ballgame hard - probably out of reach of the vast majority of adversaries). Setting it up so it requires a VPN access is probably overkill, but theoretically more secure.

You might also want to bandwidth limit the speed of the connection if you are extremely paranoid - which would mean that even if the network is breached the speed at which data can be exfiltrated could be slow - ie you could limit it to UDP only and 100kbit per second or so. (Probably not worth the effort IMHO)

Rather then disabling the phones screen, why not get a phone without a screen so it can't be enabled. (If you are concerned about technically skilled adversary, the $100 or so it would cost would not be an issue). An even more secure alternative would be to ditch VOIP for the phone altogether and connect a regular phone to an ATA across the existing wiring. This would pretty much limit the port to supporting a phone - although voice quality and functionality might be affected.

  • Thanks. I'm aware mac addresses can be cloned. But, if i remember correctly, port security disables the interface when the phone is removed. To get the MAC address, an attacker would have to unplug the phone. Plugging it back in wouldn't work because the interface would still be in shutdown mode. – user38537 Apr 21 '17 at 9:24
  • And about getting a new phone, we literally have dozens of 7911s. I'm just looking to do this such that we could replace the phone immediately should a driver damage it. – user38537 Apr 21 '17 at 9:26
  • Most devices have their MAC address printed on a label on the device. Same label that says it was inspected by the various government bodies – Ramhound Apr 21 '17 at 9:36
  • I'm not a CISCO person, so you could be right - but are you sure about this? That would mean that if the port was connected to the desktop or laptop then the device could not be rebooted without getting locked out. The reading I have done just now implies (by way of omitting any reference to how to configure this functionality) that it only allows specific mac addresses [ and can lock out on a different MAC], but does not have an option for the port to go down and then come back up again - all thats needed if I can clone the mac. – davidgo Apr 21 '17 at 9:39
  • I experimented with port-security for the switches we have and the port-security commands don't work in conjunction with switch voice vlan X. Even though the switch will accept the configuration, the interface will go into a err-disabled state. after a few moments and the phone says something like "Ethernet disconnected". – user38537 Apr 30 '17 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.