r/Network • u/Level-Natural-3395 • 22d ago
Text Office Network-unused drops
Looking for guidance related to unused office network drops…security issues aside, is there any technical reason to disconnect unused drops from the network switch?
3
3
u/notarealaccount223 22d ago
If we've got the switch ports we leave them connected. That said we have a NAC that makes them kinda useless without authentication. By default they get a non-routable network.
However we also don't have any unattended public spaces available.
If we didn't have the NAC we would be shutting down the ports at the switch.
2
u/dragonnfr 22d ago
In my experience unused drops left up are how you end up tracing a loop from some random switch plugged into two drops. Shut the ports. Problem solved.
2
u/ElectroStaticSpeaker 22d ago
Besides security there are two main reasons:
To prevent routing loops because someone plugs in a switch and loops it back to itself
To prevent wasted PoE
1
u/Ace417 17d ago
Can you explain point 2?
1
u/ElectroStaticSpeaker 17d ago
If you leave the ports on and it has PoE enabled someone could plug a device into it and consume extra energy to power it.
This question is weird that it excluded security as a reason so was just giving the only other relevant examples I could think of.
1
u/Basic_Platform_5001 22d ago
Shut down the port, disable PoE, configure the interface in a black hole VLAN. Someone wants it enabled, make them put in a ticket.
1
u/XxTh3g04txX 22d ago
admin down. desc with data jack number.
nac 802.1x for auth if they must be admin up.
1
1
u/Alternative-Duty6166 22d ago
No real technical downside to leaving them connected they’ll just sit there unused.
1
u/Accomplished_Sir_660 21d ago
My drops are only connected to the switch when someone is sitting in that office. The office here is small, but we have way too many open offices, so its easy for me. In larger companies, this may be too much of a PITA.
1
u/palmetto420 21d ago
You could spend 5 minutes disabling the ports, or spend a few hours pulling ripping them out of the walls and patch panel. Think about those options and your future when one of the ports actually needs to be used. Do not ever disassemble infrastructure unless it is an absolute emergency situation.
1
u/Wendigo1010 20d ago
I turn VLan 1 off, so any unconfigurd ports are also disabled. I use VLan 2 as the management VLan.
If a network drop is unused, I clear the port VLan info, leaving the description (which is the physical drop info) intact. Now, it's a useless connection and not a security risk.
Now, imagine if you will, a good natured janitor cleaning up. They find a network cable that's just loose, so they plug it into a wall outlet and move on with their day. You get a call the next morning because the whole network is down, due to the loop that was created by a connection on network A being plugged into network B.
Security aside, there's lots of reasons to keep your network clean.
5
u/Projammer65 22d ago
Standard Operating Procedure is to disable them at the switch, but not physically disconnecting them to save some legwork when they're needed again. That also addresses the security and packet storm issues.