RE: prevent DHCP server giving out leases to non-domain machines?



>There are DHCP products that require authentication prior to giving out
>a DHCP address and these can be linked to AD. This can be setup to
>require a user to authenticate before the first IP address is handed

You mean: a machine that has been issued a NAT-based IP at boot time loads a GUI and envokes an authentication based interface which a user must complet in order to obtain an Internet IP?

Otherwise, the products you speak of probably doesn't interface with AD at the boot time because DHCP leasing happens before AD authentication. In other words, the network traffic during DHCP negotiation does not correspond to "AD domain membership". Instead, the DHCP Server software can probably lookup MAC address of the incoming request and check it against a database of *valid* MAC addresses. But these valid MACs dont necessarily mean that a DHCP request is coming from a particular machine, afterall, one can swap network cards in and out the computer or manually change the MAC address with software.
At some point in the past, Checkpoint was making a DHCP Server software which allowed you to build a dHCP database of IPs.

Slawek

-----Original Message-----
>From: "Depp, Dennis M." <deppdm@xxxxxxxx>
>Sent: Dec 21, 2005 8:45 AM
>To: Murad Talukdar <talukdar_m@xxxxxxxxxx>, focus-ms@xxxxxxxxxxxxxxxxx
>Subject: RE: prevent DHCP server giving out leases to non-domain machines?
>
>There are DHCP products that require authentication prior to giving out
>a DHCP address and these can be linked to AD. This can be setup to
>require a user to authenticate before the first IP address is handed
>out. During the renewals you might be able to use the Machine
>authentication to renew an IP address.
>
>Dennis
>
>-----Original Message-----
>From: Murad Talukdar [mailto:talukdar_m@xxxxxxxxxx]
>Sent: Tuesday, December 20, 2005 9:00 PM
>To: focus-ms@xxxxxxxxxxxxxxxxx
>Subject: prevent DHCP server giving out leases to non-domain machines?
>
>Hi,
>Is there a way to stop a W2003 DHCP server from giving out leases for
>IP's
>if a machine does not belong to the domain?
>Or is this a fruitless question that someone simply needs to point out
>something very simple to me.
>
>A machine can't join the domain if it doesn't have an IP first(chicken
>and
>egg type thing) I can see that but obviously I'm missing something
>here-perhaps it's a question of layers-the domain is working at a
>'higher'
>layer?
>Kind Regards
>Murad Talukdar
>
>
>
>
>
>
>------------------------------------------------------------------------
>---
>------------------------------------------------------------------------
>---
>
>
>---------------------------------------------------------------------------
>---------------------------------------------------------------------------
>


________________________________________
PeoplePC Online
A better way to Internet
http://www.peoplepc.com

---------------------------------------------------------------------------
---------------------------------------------------------------------------



Relevant Pages

  • Re: Blocking Access to web-based email
    ... > authentication page, authenticate, and then get full HTTP access without ... >> PCs on the network, ... you setup DHCP with reservations for their MAC and their IP is ... > But you don't want the NAT device assigning the IP, ...
    (comp.security.firewalls)
  • Re: IAS & DHCP
    ... This is not supported by IAS. ... IAS is an authentication piece of the puzzle, ... In the future IAS and DHCP will be integrated more together and this will ... This is part of the NAP (Network access protection) services in the future ...
    (microsoft.public.internet.radius)
  • Re: MPLS network - split into sites or have flat.
    ... 'sites', and that DNS, dhcp and authentication can be done over the WAN ... I also use an IT support company, and they tell me using WAN link for dns, ...
    (microsoft.public.windows.server.networking)
  • Re: Question on Aironet 1400 with Visitor and Employee VLANs
    ... -ip helper-address to allow dhcp request ... -username guest password blabla encrypted privilege 2 ... So when the guests connects to the AP, they gets an IP from the DHCP. ... Once authentication is done they have full access. ...
    (comp.dcom.sys.cisco)
  • RE: DHCP problem in .1x
    ... authentication then the client takes IP address from DHCP.I saw on log ... REJECT for authenticaton then the trigger of DHCP on the client doesn't ... I think my switch and IAS cannot negotiate with client that has an failed ...
    (microsoft.public.internet.radius)