3

What are some good ways to handle untrusted devices on a wired network? Here are a couple of examples of what I'm thinking about:

  1. One the company owners brings his laptop in regularly and plugs in to the network.

  2. User brings in a laptop or othe device and plugs in for whatever reason, but not to be intentialy malicious.

  3. Laptop comes in from field that may have viruses but needs to be connected to get updates, etc.

All of our normal devices use static IPs. One idea I had was to turn off DHCP on our work subnet and then create 2nd subnet with DHCP setup to server IPs on it. Basically, we would end up with two subnets running on the same physical network. The idea would be that any untrusted device would get an IP from DHCP and thus put be put on the untrusted subnet.

3 Answers 3

5

Is there any reason you can't use 802.1x? Many switches support it, and all you need is a radius server or two.

It basically allows the switch to grant access only if the machine has proper credentials. The plus side of this is that if it doesn't, it is usually able to be placed into a "guest vlan" so you end up with an ethernet port that moves between guest and authenticated access.

This is per ethernet port too, so you can turn it on only on ports that are in public areas, etc. The other ports in main offices with wired desktops don't need to be affected.

It's also possible to do this on wireless access points.

All of this requires slightly higher-end equipment, but depending on how much your time is worth, it may be worth it to just do it once, and not have to roll your own thing. Every major OS has 802.1x support built in these days so unless you are being elaborate and using certificates, there is nothing to install on a client other than a one-time username and password in a control panel.

1
  • Thanks. I didn't even know there was such a thing as 802.1X.
    – poke
    Dec 19, 2010 at 5:01
3

You could implement some sort of NAC (Network Access Control) device. There are multiple commercial products, but there are also open source solutions such as Packetfence.

1

That could be the "no cost" solution.

There are other switches features like:

  • Port security
  • IP Guard
  • DHCP snooping

And so on.. You should search for "layer 2 security".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .