Re: How to block a client from DHCP?
From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 12/04/04
- Next message: Steven L Umbach: "Re: Enumerating doamin users in another domain"
- Previous message: Jéjé: "Re: Routing through VPN (with RRAS) = remote network not reachable..."
- In reply to: Harvey: "Re: How to block a client from DHCP?"
- Messages sorted by: [ date ] [ thread ]
Date: Fri, 3 Dec 2004 20:49:14 -0600
802.1X authentication would work but requires a Certificate Authority, IAS
server, and compliant operating systems. The link below explains how this
can be done.
http://www.hp.com/rnd/pdf_html/guest_vlan_paper.htm
Another option is to use switches that can protect the network based on mac
addresses. This is not as secure as 802.1X but will prevent the average user
from gaining access by filtering switch ports to allow only certain mac
addresses. Even the lower end HP Procurve switches can do mac filtering for
example and have a "learning" mode to greatly reduce the need to manually
configure mac address tables. My HP2512 switch also can do port isolation
where you can configure ports on switches can access a common port such as
an internet gateway but not each other.--- Steve
"Harvey" <Harvey@discussions.microsoft.com> wrote in message
news:47C6055D-E00B-4AF4-BCCB-8ED9239FB32C@microsoft.com...
> Then, can I deny any non-domain-member computers from using our domain
> dhcp
> server? This is because some people bring laptop from home and simply
> plug
> into the wrok place's network port. Those computers, very often, are not
> set
> up correctly from security point of view, easy to be hacked and then hack
> other systems. If I can block non-domain-member computers, then they have
> to
> ask me to check and set up the system and it will be much safer.
>
> Any suggestion? Thanks a lot!
>
> Harvey
>
> "Phillip Windell" wrote:
>
>> No. You would have to just give the machine a static address to begin
>> with.
>>
>> There are pre-authentication techniques out there for creating
>> "quarentine
>> zones" for machines before they are allowed to get an address and be on
>> the
>> network, but those things are complex and are still "early" in the
>> developement cycle.
>>
>> --
>>
>> Phillip Windell [MCP, MVP, CCNA]
>> www.wandtv.com
>>
>> "Harvey" <Harvey@discussions.microsoft.com> wrote in message
>> news:B4D1407E-8069-4362-89F7-AF6B447C0B15@microsoft.com...
>> > We have a dhcp server (win 2000). It is running normally. Is there any
>> way
>> > to block a workstation from using our dhcp server if I know the
>> workstation's
>> > MAC address?
>> >
>> > Thanks!
>> >
>> > Harvey
>>
>>
>>
- Next message: Steven L Umbach: "Re: Enumerating doamin users in another domain"
- Previous message: Jéjé: "Re: Routing through VPN (with RRAS) = remote network not reachable..."
- In reply to: Harvey: "Re: How to block a client from DHCP?"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
