1

Some of my users need to have an IP from a specific range to use some services and some others don't. Since many users have access to different PCs (and sometimes they share the same PCs, too) is it possible for Windows Server 2012 DHCP to assign an IP address based user name?

I did some researches and it looks like it's not possible, since the DHCP addresses are assigned before a user logs in. Am I right?

I found that DHCP policies in Windows Server can be based on one ore more of these parameters:

  • MAC Address
  • Vendor Class
  • User Class
  • Client Identifier
  • Relay Agent Information

but I think they are all related to the hardware installed on the PC.

How can I solve this problem? I thought about a login script that changes the IP after the login, but in this case I need to statically assign a different IP to each user. Is there a way to achieve this dynamically?

9
  • 1
    Why would you want this? Seems like adding needless complexity. If you're looking at using some kind of Internet usage monitoring solution most of the "name brand" offerings support either transparent proxy authentication by the clients or, alternatively, some kind of "agent" to detect the logged-on user. Feb 4, 2013 at 20:40
  • 1
    @EvanAnderson You see this sort of thing a lot in education. If a student is logging in to a lab computer you might want them in a different VLAN than an administrator logging into the same computer. Or you might want faculty/staff to be on a different wireless VLAN with different ACLs (or traffic shaping policies) than a student, but you don't want to mess with multiple SSIDs, so you handle it with 802.1x or one of the fancy packages that puts a neat bow on it like Clean Access.
    – MDMarra
    Feb 4, 2013 at 20:43
  • Thank you all for your answers. @EvanAnderson we need this because some users have to access a VPN, some others don't, and our goal is not to install the VPN client on each PC, but create something that works at a lower level (transparent to the final user).
    – J.B.
    Feb 4, 2013 at 20:55
  • 1
    The HUGE issue with this is that this could be bypassed by simply setting a static IP address on the machine. This is the kind of thing that 802.1x and NAP were created for.
    – woodsbw
    Feb 4, 2013 at 21:45
  • 2
    That isn't really something I can cover in the comments, and it doesn't really belong in this question they way you have asked it. I kinda think you asked the wrong question, by proposing an unusual solution. You should have focused a lot more on explaining your actual root problem.
    – Zoredache
    Feb 4, 2013 at 21:45

3 Answers 3

7

What you want to do is some form of 802.1x at the switch level with something like a NAP (Windows) or FreeRADIUS (*nix) back end. When a client connects initially, they are all put on a "quarantine" VLAN that doesn't have access to anything except logging in. Then, based on either their computer certificate or logon name or group membership in AD, they are put on the correct VLAN at the switch-port level.

You can't do this natively with DHCP, you need switches that support 802.1x and RADIUS as a minimum or something like Cisco Clean Access or ISE, but those do far more than VLAN quarantining.

3
  • 1
    DHCP won't do this for you because: by the time you've logged in, your PC has already been assigned an IP address.
    – longneck
    Feb 4, 2013 at 20:35
  • Sorry, didn't mean to imply that you did. Just wanted to add to your already excellent answer. :)
    – longneck
    Feb 4, 2013 at 20:37
  • 1
    This ^ is how you do it. Takes a bit to setup...but it will work, and work securely.
    – woodsbw
    Feb 4, 2013 at 21:47
2

Not using any sane built-in method.

There's two reasons:

  1. DHCP leases are renewed at either boot time (to get an IP address), or half way through their lease time (so on a 7 day lease, they are renewed at 3.5 days), or if that renewal is unsuccessful then more frequently. But there's at least a (for example) 3.5 day wait between renewals
  2. No DHCP agents or servers will send the logged on user as part of its request (as it's not in the spec).

I guess if we're waving hands around, you could possibly do this with a logon script. Send a request to your custom-made DHCP server, get a custom-made DHCP response (to your script) and then manually set the IP address. Or, perhaps, send a custom-made request to the DHCP server that adjusts your resevation IP address and then manually trigger a renewal, but they're both Doing It Wrong TM

1

Take a look at Remote Desktop Services IP Virtualization. You will be able to assign IPs per session. I don't know whether you can control which IP is assigned to a user. More to find in the RDS team blog:

http://blogs.msdn.com/b/rds/archive/2009/07/09/configuring-remote-desktop-ip-virtualization-part-1.aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .