First, tying the MAC with the drop method works well. For the mobile users you can leave some drops without MAC restriction at certain locations. This will help you identify who's on the network, both by location and drop tag.
Second, MAC filtering can be enabled on gateways/routers to keep unwanted users off your network. By enabling this feature, the device will compare each connecting computers MAC address against an internal manually configured list populated by the owner of the router. If the MAC address is on the list, the connection is permitted. While this is a nice feature, do not rely heavily on this form of security.
Third, the best way to achieve this is to use VLANs. VLANs feature port-based access control to help secure switch port access by requiring the client to authenticate itself before being granted access to the network. Data cannot pass through the switch and onto the LAN until the client's identification has been verified. Some of the enterprise switches offer an added security layer that uses a MAC address lock-down scheme to deny port access to any device that is not registered to that port. This will enable you to retain Internal security while allowing access to authorized mobile users.
If you need more information, check out our VLANs topic page.
Dig deeper on Network Security Best Practices and Products
Related Q&A from Puneet Mehta
To view network security expert Puneet Mehta's latest advice, see his Public Profile on the IT Knowledge Exchange: http://...continue reading
Find out if there's a difference between a virtual private network (VPN) concentrator and a network access server (NAS) in this explanation from our ...continue reading
Our network security expert explains how to keep unauthorized users from accessing your router's IP address for Internet access in this advice ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.