Re: IP address assignment problem

Davy Davidson wrote:

I have a little problem and seek for ur thoughts, let's assume I'm in a very open environment where everyone can very easily try to get his/her laptop on the network and IP addresses are assigned by a DHCP server and we are in a domain environment, how do I prevent machines that are not part of our domain to be assigned an IP address?

This is a chicken-egg-problem: Since DHCP is preceding all meaningful communication in most networks, this only can be done by denying DHCP communication beforehand. The Clients will need to prove that they are members of the domain before they are able to get served by a DHCP server. You can achieve this by using 802.1x throughout your network, but this will require appropriate equipment.

Mostly, the problem "I do not want to get them a DHCP address" can be refined as "I do not want them to communicate with any of my domain members" which can be achieved by for example only allowing encrypted communications (i.e. implementing IPSEC) for every domain member. You should be able to trust the domain authentication mechanisms not to let just anybody to get to your domain machines, providing your password policy is feasible, your systems are patched and access controls are set correctly (read: with the least privelege needed).

Denis

---------------------------------------------------------------------------
---------------------------------------------------------------------------

Relevant Pages

  • Re: networking private and public hosts questions
    ... some systmes in storage to create a test network. ... a WS to the child and attempted to pull an IP from the DHCP server, ...
    (microsoft.public.win2000.networking)
  • Re: A little FYI
    ... > fix for a different problem or end up making the same configuration ... Maybe faulty network equipment, ... > to look at what might interfere with DHCP. ... you were not here as I was trying to get the card to stay ...
    (comp.security.firewalls)
  • Re: Preventing DHCP from allocating IPs
    ... Each segment is physically separate with a Linux ... unknown MAC addresses firstly don't get a DHCP ... >> wants access to your network, they will have to come to you to obtain ...
    (Security-Basics)
  • Cable Connectivity
    ... address for the Network Card with network address 00402B2F688C. ... The DHCP Client service on your computer did not receive a response ... If connection with the network is not established using this APIP ... the DHCP Client service will try to contact the DHCP server ...
    (microsoft.public.windowsxp.general)
  • Re: Exchange not loading properly, since updates?
    ... No other DHCP services running on the network. ... >> here is the changelog text, ... >> Old Subnet Mask: 255.255.255.0 ...
    (microsoft.public.windows.server.sbs)
Quantcast