Locking down unused ports while allowing Internet Access

[Wrandall]

Forgive my ignorance, but I'm fairly new to custom Meraki configurations.

We have multiple locations with Meraki switches and are seeing users plug in devices without approval.  I'd prefer to just disable ports that aren't used, but the higher ups want the ports to allow Internet access to allow a user to still email IT to have the port configured.  What's the easiest way to do this?

[DarrenOC]

Hi @Wrandall , we typically shut down all unused ports and place them into a non-routed vlan to stop anyone connecting devices into a network that isn’t authorised to do so.

You also have other options such as Radius authentication for devices and users that are authorised to be on the network. Anything that shouldn’t connect into placed again into either a guest vlan or de-authorised.

Also look at Cisco ISE.

[Make_IT_Simple · Accepted solution]

Create a new VLAN and apply a group policy by VLAN and only allow access to certain resources such as email. Then tag any unused port with the new VLAN that you created. 

Creating a Group Policy

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying...

Apply group policy by VLAN:

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying...

 

[BlakeRichardson]

Glad I had the same thoughts as everyone else, while you can disable ports its probably easier to untag them with a unused VLAN and that add a Port TAG as well with something like "SPARE"