Secure network against illegal users

Secure network against illegal users

We run NT servers with Windows 2000 workstations. We're having a problem with users illegally putting laptops on our network. We find their MAC addresses from our DHCP Manager. How can we block certain MAC addresses from accessing our network?

    Requires Free Membership to View

    Login

    By submitting your registration information to SearchNetworking.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchNetworking.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

If you use managed Ethernet switches, you may be able to configure switch ports to bind them to known, authorized MAC addresses. This method is simple but does not scale well and can be defeated by MAC spoofing (users changing their laptop MAC address).

Your DHCP manager may support MAC Address Access Control Lists, giving out IP addresses to known, authorized MACs while denying requests from everyone else. This method is slightly more scalable -- the same ACL works no matter which switch port or AP a given laptop is using. However, it is still vulnerable to MAC spoofing.

Many new Ethernet switches and wireless APs support 802.1X Port Access Control. 802.1X is designed to overcome MAC spoofing by dynamically enabling/disabling a LAN port based on something more than MAC address. Specifically, the wired or wireless laptop will be challenged for credentials and must authenticate before network access is granted. To use 802.1X, you will need an Authentication Server that supports 802.1X, but you can probably run that on one of your NT servers and leverage your Windows workgroup and domain to authenticate LAN users. To learn about 802.1X, check out searchNetworking's Wireless Lunchtime Learning Access Control lesson.

Finally, you can also control access to your NT servers at a higher layer. For example, you could put a small business firewall between the servers and all LAN stations, requiring users to log in at the firewall to gain access to the server subnet. Or you could require domain login when workstations access individual applications and shared files/printers offered by your NT servers. Ideally, you should consider creating a layered defense by controlling access to both your LAN and your network/applications.

This was first published in August 2006

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top