Blocking non domain users access to internet

[dgallegos]

I need to be able to block anyone who brings there personal laptop into the office from the internet. i dont think that Microsoft DHCP can stop this and i know that isa does but the company cant afford the software is there a way to setup the scope so that only computer names already on the domain have access and that no one with external personal notebooks have no access.

TIA

 

[Jpoandl]

MS DHCP can be configured manually to only give out DHCP addresses to pre-defined MAC addresses. This would help your problem....but would take you tons of time configuring each MAC addresses for your DHCP scopes.

The only other way, I can think of is to install a FIREWALL or proxy server.



Joseph L. Poandl
MCSE 2003

If your company is in need of experts to examine technical problems/solutions, please contact

http://www.NJCOMPUTERNETWORKS.com

(Sales@njcomputernetworks.com)

 

[buddafish]

How about a written security policy the prohibits the use of personal devices on your network. Outside devices on your wire is a disaster waiting to happen.

With that said... Jpoandl's suggestion is the best way. MAC address filtering. This can also be done on most managed switches. So if a non-business MAC address attempts to get on the wire, the port that the jack is attached to will block all traffic. We have used this and it really raises the blood pressure of the offending users.

just some thoughts

scottie

 

[mswilson16]

hey guys, I am having the same problem, some of my users are bringing their personal laptops into work and surfing... I to do not have the money to install ISA but I do however have a firewall.

What would be the best way for me to stop any machine that is not a member of the local domain getting an IP address?
(I feel that getting the DHCP scope to only allow certain MAC Addresses will create to much maintenance... is there anything else?).

Thanks in advance

Mswilson

 

[PaulGillespie]

You could give all your PCs static IPs and setup DHCP to only give out a small range so the laptops would be given a dhcp address from the server. Now configure your hardware firewall to deny http traffic from the lan to the wan for that small IP range. Depends how big your company is though.