MAC Verification

[NightyNight]

Right now, there is a network set up with DHCP. I need a way in which I can track and confirm PCs plugging into my network by using a MAC address verification system. So necessarily, I need a way to only allow certain laptops to plug into the network, with access based on the computer type instead of passwords/usernames.

The reason that passwords/usernames will not work, is that this is a school network, and each student has their own username, I do not want them to bring their laptops and plug into an open outlet and start surfing with their personal computer. I want to be able to pick and choose which laptops to allow on my network.

The network in itself consists of about 200 PCs.

 

[Fint]

You could setup DHCP reservations [based on MACs], and anything without a reservation doens't get an IP (or gets an IP that is ACL'ed to go no where). This won't stop someone from setting static and plugging in; you'd really need 802.1x (with username/password authenication) to do that.

 

[vmerc]

What do you have serving the DHCP?

 

[oakfan52]

what kind of switches do you have? A lot of managed switchs have port securoty features wheich will only allow a givin MAC on that port.

 

[XOR != OR]

And keep in mind MAC addresses are easy to fake.

 

[oakfan52]

And keep in mind MAC addresses are easy to fake.

true but you would need to know the mAC for that open port. I mean nothing is 100%.

 

[XOR != OR]

true but you would need to know the mAC for that open port. I mean nothing is 100%.

As I understand it, wireless signals send MAC addresses in the clear. So for wireless purposes, they aren't really worth the effort.

On a switched network, its a bit more difficult, but even then there are ways.

 

[hokatichenci]

true but you would need to know the mAC for that open port. I mean nothing is 100%.

To do that on a per "port" basis you would require a switch with hardening abilities (managed switch == $$$). DHCP or routers that filter out all MAC traffic that arn't on the list is probably the best (although most insecure) way to do it.

 

[oakfan52]

To do that on a per "port" basis you would require a switch with hardening abilities (managed switch == $$$). DHCP or routers that filter out all MAC traffic that arn't on the list is probably the best (although most insecure) way to do it.

well he said 200 PC's. So i doubt he running linksys...atleast i hope not.

 

[YeOldeStonecat]

200 PCs...I'd hope he's running a server? What server(s) are you running? 2K3 AD? Network of more than 20 PCs and hopefully there is a server..which hopefully would run DHCP instead of some router.

 

[vmerc]

Seriously we need more information here if you want help nightynight.

 

[NightyNight]

Server 2003 AD Domain Controller

 

[vmerc]

Server 2003 AD Domain Controller

Why don't you use machine name authentication?

You would have to set up each client once on the network, but after that, AD controls the network access.

And no machine name auth cannot be "easily" tricked by naming an imposter machine something else. AD uses auth certs signed by admins to verify the machine. (An admin has to manually use login/password to auth a machine one time to init.)

 

[GroundNPound]

Why don't you use machine name authentication?

You would have to set up each client once on the network, but after that, AD controls the network access.

And no machine name auth cannot be "easily" tricked by naming an imposter machine something else. AD uses auth certs signed by admins to verify the machine. (An admin has to manually use login/password to auth a machine one time to init.)

QFT

This doesn't mean you'd be preventing people from grabbing an IP and having network layer (layer 3) access to the 'network', but it would provide a way to control access to your windows network services. I wasn't clear on whether or not he was talking about the network layer or the 'windows network'. Perhaps the OP can clarify exactly what activities he'd like to prevent?