DHCP leases 1

[DFavel]

Hello,

Does anyone know if there is a way to not give out a DHCP lease to a guest account when they plug into an internal LAN connection?

Meaning, when a contractor comes to our site and plugs in to our LAN, is there anyway to stop them from getting a DHCP lease? Have had problems with contractors infecting the LAN. I have no problem givin them internet access, but dont want them to connect through the main LAN. Any ideas? Has anyone heard of or used the HP's Guest LAN product?

Thanks in Advance,

BigDman26
A+, N+, Security+, MCSE+I

 

[Eyas]

Perhaps not a solution based on DHCP but I would set up a separate VLAN on the port they connect to. That way you can handle the trafic just as you like.

/Eyas

 

[DFavel]

Thanks Eyas,

I was thinking that root, but want a solution that is based on login authentication rather than setting up a vlan on a physical drop or port. Since everybody who is authorized to the network already has a user account in AD.

I have heard a little about about a internal Radius server that will bridge authentication databases with Kerberos and drop any non-authenticated users into a Guest VLAN with specific amount of permissions.

I have heard of HP Guest VLAN doing this but you must use the HP ProCurve line of switching hardware for the entire internal LAN. I am looking to see if there is away of doing this with the current mixed environment of HP and Cisco switchs.

BigDman26
A+ N+ Security+ MCSE+I

 

[GlenJohnson]

How many normal users? Can you set up authentication based on mac addresses?

Glen A. Johnson
If you're from Northern Illinois/Southern Wisconsin feel free to join the Tek-Tips in Chicago, Illinois Forum.
TTinChicago
Johnson Computers

 

[Code666]

an idea i saw somewhere else

"Create an address lease that's invalid for your network, & reserve it to the MAC address of the laptop. They'll still get an address leased to them, but not one that will allow them to communicate to the rest of the network (or even out to the internet)."

of course you would have to get the MAC address in order for this to work but it sounds like it can be used in a pinch...