Detecting/Preventing Rouge Clients

[PU36]

I'm running Windows 2003 utilizing DHCP for all clients. Every day I see that a non domain computer connects to our VPN (Sonicwall) and obtains an IP address fromour DHCP Server.

How can I prevent this user from getting an IP address OR how can I give this computer an IP address on a different netework and scope that they will be forced to contact up to setermine the issue?

I have tried to create a new scope with a Class C network (We are on an A) and had their mac to the reservation. However the VPN always gives the computer the current network.

Any thoughts would be great.

Thanks

 

[Roadki11]

I dont understand your issue. Is this an unauthorized connection to your vpn? If that is the case i would be more concerned about the breach of security at your router. Vpns should require some sort of authentication to complete the vpn connection. You should change the passwords.

RoadKi11

 

[PU36]

It does require authentication and a certificate, however the machine that connects is not part of our domain, which leads me to think that a remote user have moved the client/cert/password to their home machine and is accessing or netowkr from there. I want to find out who this user is but forcing them to contact us with network issues.

Judging by the logs they are connecting to the VPN and accessing only 1 machine on our network. It is machine desinged for specific tasks and only partiular people would ever access it, so before I just go ask the people I want information about why is a "Non-Domain" computer accessing our network?

 

[Roadki11]

I am not familure with Sonicwall or how robust they are. have you looked through the sonicwall interface for a method to block/deny traffic from a MAC or IP?

RoadKi11

 

[PU36]

I have looked and I couldn't find anything regarding that. That is the first place that I looked.

It might be bury in one of the features sets but for the life of me can't find it.

 

[Stevehewitt]

Change the VPN passwords.




Steve.

"They have the internet on computers now!" - Homer Simpson