First, tying the MAC with the drop method works well. For the mobile users you can leave some drops without MAC restriction at certain locations. This will help you identify who's on the network, both by location and drop tag.
Second, MAC filtering can be enabled on gateways/routers to keep unwanted users off your network. By enabling this feature, the device will compare each connecting computers MAC address against an internal manually configured list populated by the owner of the router. If the MAC address is on the list, the connection is permitted. While this is a nice feature, do not rely heavily on this form of security.
Third, the best way to achieve this is to use VLANs. VLANs feature port-based access control to help secure switch port access by requiring the client to authenticate itself before being granted access to the network. Data cannot pass through the switch and onto the LAN until the client's identification has been verified. Some of the enterprise switches offer an added security layer that uses a MAC address lock-down scheme to deny port access to any device that is not registered to that port. This will enable you to retain Internal security while allowing access to authorized mobile users.
If you need more information, check out our VLANs topic page.
This was first published in August 2005