DHCP Security

[seerockcity]

I am looking to configure my DHCP server (2003 SBS) so that it only assigns IP addresses to MAC addresses that are on our network. How do I do this. I know how to create a reservation and such. Is this the same thing? Thanks in advance!!

 

[dotobi]

Sure there must be a better way to do this, but...

if you have, say, 10 reservations 192.168.0.1 through to 192.168.0.10), you could right click on your scope and select properties, then enter the start IP (192.168.0.1) and your end IP (192.168.0.10) for distribution. This way there would be no more IP addresses for distribution as the only one's available would be reserved.

However, this approach would not stop someone from manually entering the correct TCP/IP info manually on a computer and hence, would have access to the network. Does anyone know how to overcome this problem?

Thanks

 

[LWComputingMVP]

I have never heard of or seen a way to limit the Microsoft DHCP server like this OTHER than using reservations and limiting the scope. In addition, as dotobi points out, all one has to do is enter the correct IP info manually and they get on your network.

If you want this type of security, you're probably better off using a Linux DHCP server or possibly some of the DHCP servers built in to managable switches/routers like Cisco's. Note: you CAN use other DHCP servers with Active Directory, you just have to make sure they give out correct information.

 

[ShackDaddy]

To answer your original questions: yes, limit your scope to 10 addresses and create a reservation for each address.

To go beyond your topic and address other questions raised: there are also devices that limit access to the network to clients that have a certificate. The protocol standard that defines this is 802.1X if you want to Google for devices that support it. You can also read more about it here:

http://www.microsoft.com/technet/community/columns/cableguy/cg0402.mspx

The article is mainly about wireless connections, but it also applies to wired.

And here:

http://technet2.microsoft.com/Windo...bc4f-4765-b105-fe0b538caf191033.mspx?mfr=true

One thing you could do (after researching the particulars and their effects) is switch on the 802.1X capability that is in XP (turned on by default) and 2003 Servers and enforce certificated encryption of all communication on your network. That might still allow someone to use your router, but you should also be able to specify a narrow range of addresses on your router that are able to use it. Some routers allow you to limit access by MAC address.

All this to say, you may already have the materials you need to make your network unusable for someone who plugs into it, even if they assign an IP that's in your subnet.

ShackDaddy

 

[58sniper]

In theory, you could also limit your infrastructure equipment to allow traffic from certain MAC addresses.

Seems like a lot of admin overhead, though.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt