Limit Internet Access to domain users only

[MD5150]

Currently, any computer plugged in to our network gets access to the internet. And sometimes this is useful, like when someone brings in a machine from home that needs fixing and we need to download drivers or whatever. On the other hand, I have manufacturing operators on the graveyard shift that can bring in their own laptops, plug into a desktop switch, and surf the web freely, which we don't allow them to do as they really do need to concentrate on their work.

So is it possible to limit internet access to only those computers on our domain, and if we want a non-domain machine to access the internet, we can do a quick procedure of some sort for allowing it to connect?

We already have a guest wireless in place, but this is more for desktops without wireless, and for preventing access at the desktop switch level.

We've talked about building a box for the switch, but I'd rather fix the problem using network permissions or GP or something.

Any suggestions on the best way to do this?

Thanks,

Mike

 

[cajuntank]

My first inclination is to say that you'll have to have a proxy/filter appliance involved in that flow as well. My appliance is Active Directory aware so being a member of a specific group grant's or deny's (and at different levels) access out to the Internet.

Authentication could also be done at the switch level (if you have a switch that can do that) to where if they do not authenticate correctly, then that port is diabled, or they get put into a non-routable vlan that cannot access the Internet, or something like that.

Doing it via AD permission/policy only, would involve, and I'm guessing, some way to strip the IP configuration off of the machine if not properly authenticated... don't know if that could be done or not... never thought to try.

 

[58sniper]

You didn't mention how your infrastructure is laid out, but some can provide access based on RADIUS (IAS) authentication. We use it for VPN access. RADIUS requires the user be a member of a specific group.

It might be something to look at.

Other solutions, like Websense, can grant access to specific users and groups, and even provide granularity as to what each user/group can access.

Pat Richard
Microsoft Exchange MVP
Contributing author Microsoft Exchange Server 2007: The Complete Reference

 

[MD5150]

We're running Win2003 Server with 2 basic 24-port Linksys switches in the rack and with a basic Linksys firewall.

Thanks for the suggestions. I think I understand what has to be done now. A tool that taps into the AD groups sounds like the way to go. I'll have to see what is available within our price range.

Thanks for the tips.

Mike

 

[juniper911]

Its not cheap but you could look at MS ISA 2004, you can then create groups which are allowed to web browse or not web browse. There are many more things you can do e.g. allow access to particular sites and block access too...

 

[akalinowski]

dans gaurdian would accomplish this and its way cheaper than isa.

akalinowski

http://www.nofear.com

MCSE 2000, A+, N+, LCP, CNE