What is MAC Binding?
MAC Binding is a layer 2 security measure in which a managed switch ties a specific MAC address to a single switch port, to an IP address or to both, and rejects any traffic that does not match that binding. Variants are also called MAC Address Binding, MAC-to-Port Binding or IP-MAC-Port Binding. In OT networks, where the set of devices on each port stays the same for years, MAC Binding makes it harder to plug in an unknown device or to impersonate a trusted PLC, HMI or SCADA component.
MAC Binding is not authentication: a MAC address is easy to forge. The measure works because an attacker has to make the right address appear on the right port, and that requires physical access.
🧠 What is the purpose of MAC Binding?
MAC Binding serves four purposes:
- Keep unauthorised devices out - a laptop, rogue device or unmanaged switch on a spare port gets no traffic through.
- Make spoofing harder - a copied MAC address on a different port is recognised as a move and blocked.
- Increase network control - administrators record exactly which device belongs on which port, so a replacement or re-cabling becomes visible immediately.
- Complement access control and network segmentation - binding protects the edge of a zone, segmentation limits what an intruding device can reach afterwards.
🔧 How does MAC Binding work?
A switch normally learns every source address arriving on a port and stores it in its MAC address table (CAM table). MAC Binding replaces that free learning with a fixed list:
- Every device has a MAC address of 48 bits, the first 24 of which (the OUI) identify the manufacturer.
- The administrator records the binding: MAC X is only allowed on port Y, optionally extended with and only with IP address Z.
- The switch checks every incoming frame. If a different source address arrives on port Y, the traffic is rejected.
- If MAC X appears on another port in the same VLAN, the switch treats it as a violation. Cisco calls this a MAC move violation.
- The switch responds by dropping, dropping and alerting, or shutting the port down, depending on the configuration.
In practice there are three variants, which vendors name differently:
| Variant | What is bound | Protects against | Typical implementation |
|---|---|---|---|
| MAC-port binding | MAC address ↔ switch port | Foreign devices, MAC moves | Static secure MAC in port security, static entry in the MAC address table |
| IP-MAC binding | IP address ↔ MAC address | ARP spoofing, IP forgery | Static ARP entries on a router or firewall, FortiSwitch IP-MAC binding |
| IP-MAC-port binding | IP ↔ MAC ↔ port | Foreign devices, MAC moves and ARP and IP forgery | IP Source Guard with static bindings, D-Link IMPB (IP-MAC-Port Binding) |
In the dynamic form, DHCP Snooping fills the binding table automatically from the DHCP leases it observes. In OT, however, most devices have a fixed IP address, so you enter the bindings manually there.
🏭 Where do you apply MAC Binding in OT environments?
| Component | Reason for binding | Point of attention |
|---|---|---|
| PLCs | Prevent a replacement or forged device from joining unnoticed | Update bindings at every hardware replacement |
| SCADA servers | Lock down critical control interfaces | Virtual servers may change MAC address during migration |
| I/O stations and RTUs | Remote cabinets are physically vulnerable | Often a built-in switch: several addresses per port |
| HMI panels | Panels sit on the shop floor with reachable ports | Plan for the vendor’s service laptop in advance |
| Service and spare ports | The first place an outsider plugs something in | Better disabled than bound |
Not every port is suitable. Uplinks between switches and ring ports in ring redundancy see many addresses pass by and get no binding. ProfiNET devices with a built-in two-port switch for daisy-chaining carry the addresses of downstream devices, so they need a list of several addresses.
⚙️ How do you set up MAC Binding step by step?
- Take inventory - first build an asset inventory with MAC address, IP address, switch and port for every device. Passive monitoring provides this data without disturbing the process.
- Choose the variant per port - MAC-port binding for fixed field devices, IP-MAC-port binding where ARP spoofing is a real risk.
-
Configure - on Cisco switches with
switchport port-security mac-address 0011.2233.4455(static secure address) or with a global static entrymac address-table static 0011.2233.4455 vlan 10 interface Gi1/0/5. That static entry only pins the address to the port and does not keep other devices off it; you still need port security for that. FortiSwitch has a separate IP-MAC binding table of up to 1,024 rules, which you enable globally and switch on or off per port. - Choose the response - on ports facing controllers, restrict (drop and alert) is usually safer than shutdown, because the port stays up for the legitimate device.
- Test in a maintenance window - check that all process communication keeps running, including after a restart of switch and device.
- Report violations - send syslog or SNMP traps to your SIEM or network monitoring.
- Embed it in change management - updating the binding should be a fixed step in every replacement procedure.
🔐 What are the limitations of MAC Binding?
- MAC addresses can be forged - every operating system lets you set a different MAC address. Anyone who unplugs the right device and connects a laptop with its address to the same port gets past a pure MAC-port binding.
- No protection against ARP forgery - an attacker using their own, permitted MAC address can still send forged ARP messages and take up a Man-In-The-Middle position. That requires Dynamic ARP Inspection or an IP-MAC binding.
- Administrative burden - every replacement of a network card, PLC or HMI needs a configuration change. If it is missed, communication drops at the very moment a fault is already being handled.
- Uneven support - not all industrial switches support binding per port or per VLAN, and unmanaged switches do not support it at all.
That is why you deploy MAC Binding as one layer within defence in depth, alongside stronger measures such as 802.1X or NAC wherever devices support them.
🔄 How does MAC Binding relate to similar measures?
| Measure | What it does | Relationship to MAC Binding |
|---|---|---|
| Port Security | Limits the number and identity of MAC addresses per port | Static or sticky secure addresses are the most common form of MAC Binding |
| MAC Filtering | Allow list or block list of MAC addresses, also on Wi-Fi | Filters without tying an address to a fixed port |
| DHCP Snooping | Builds a table of IP, MAC, VLAN and port | Supplies dynamic bindings |
| IP Source Guard | Drops IP traffic that does not match the binding | Extends binding to the IP address |
| Dynamic ARP Inspection | Checks ARP messages against the binding table | Closes the ARP gap that MAC-port binding leaves open |
| 802.1X | Authenticates devices cryptographically via RADIUS | Stronger alternative; MAC Authentication Bypass (MAB) falls back to the MAC address |
🇪🇺 What role does MAC Binding play in IEC 62443 and NIS2?
IEC 62443-3-3 requires identification and authentication of devices (SR 1.2) from security level 2. MAC Binding alone does not meet that requirement, because no secret or certificate is involved, but it does support SR 7.7 (least functionality, unused ports closed) and SR 7.8 (control system component inventory). For many field devices without an 802.1X supplicant, it is in practice the best achievable compensating control.
Organisations covered by NIS2, implemented in the Netherlands through the Cyberbeveiligingswet that entered into force on 15 August 2026, must take appropriate measures to secure their network and information systems. Documented port security with MAC Binding, linked to an up-to-date asset inventory, is a concrete and demonstrable part of that.
❓ Frequently asked questions
What is the difference between MAC Binding and MAC Filtering?
MAC Binding ties a MAC address to a specific switch port or a specific IP address, so the same address is rejected anywhere else. MAC Filtering works with a list of permitted or blocked MAC addresses, regardless of the port. MAC Binding is therefore stricter, but also needs more administration.
Does MAC Binding protect against MAC spoofing?
MAC Binding offers only partial protection against MAC spoofing. A forged address on a different port is blocked, but anyone who unplugs the legitimate device and connects their own device with the same address to that port gets through. Combine MAC Binding with physical security, monitoring of link-down events and, where possible, 802.1X.
What happens to MAC Binding when I replace a PLC?
A replacement PLC has a different MAC address, so MAC Binding rejects the new device until the binding has been updated. Make adjusting the binding part of the replacement procedure and of your change management. Note that with ProfiNET, the controller recognises a replacement device by its device name, but the switch looks at the MAC address, so the binding still has to be updated.
Does MAC Binding help against ARP spoofing?
Pure MAC-port binding does not help against ARP spoofing, because attackers use their own permitted MAC address and only forge the IP mapping. That requires IP-MAC binding, IP-MAC-port binding or Dynamic ARP Inspection. These check whether the IP address in an ARP message belongs to the MAC address and the port.
Do industrial switches support MAC Binding?
Most managed industrial switches support MAC Binding through port security with static or sticky MAC addresses. More extensive variants such as IP-MAC-port binding and IP Source Guard are less widely available and differ in name and features per manufacturer. Unmanaged switches do not support MAC Binding.
Is MAC Binding sufficient for IEC 62443?
MAC Binding is not sufficient for the device authentication that IEC 62443-3-3 requires from security level 2, because a MAC address is not cryptographic proof of identity. It is, however, a useful compensating control for devices that do not support 802.1X. Document that choice in your risk assessment.
📌 In summary
MAC Binding ties a device at layer 2 to a switch port, an IP address or both, providing a simple first barrier against unknown devices and spoofing in OT networks. The measure needs no software on the endpoints, but it is not true authentication. Combine MAC Binding with port security, Dynamic ARP Inspection, network segmentation and monitoring, and make updating bindings part of your replacement procedure.