Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What are some good ways to handle untrusted devices on a wired network? Here are a couple of examples of what I'm thinking about:

  1. One the company owners brings his laptop in regularly and plugs in to the network.

  2. User brings in a laptop or othe device and plugs in for whatever reason, but not to be intentialy malicious.

  3. Laptop comes in from field that may have viruses but needs to be connected to get updates, etc.

All of our normal devices use static IPs. One idea I had was to turn off DHCP on our work subnet and then create 2nd subnet with DHCP setup to server IPs on it. Basically, we would end up with two subnets running on the same physical network. The idea would be that any untrusted device would get an IP from DHCP and thus put be put on the untrusted subnet.

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

Is there any reason you can't use 802.1x? Many switches support it, and all you need is a radius server or two.

It basically allows the switch to grant access only if the machine has proper credentials. The plus side of this is that if it doesn't, it is usually able to be placed into a "guest vlan" so you end up with an ethernet port that moves between guest and authenticated access.

This is per ethernet port too, so you can turn it on only on ports that are in public areas, etc. The other ports in main offices with wired desktops don't need to be affected.

It's also possible to do this on wireless access points.

All of this requires slightly higher-end equipment, but depending on how much your time is worth, it may be worth it to just do it once, and not have to roll your own thing. Every major OS has 802.1x support built in these days so unless you are being elaborate and using certificates, there is nothing to install on a client other than a one-time username and password in a control panel.

share|improve this answer
    
Thanks. I didn't even know there was such a thing as 802.1X. –  poke Dec 19 '10 at 5:01
add comment

You could implement some sort of NAC (Network Access Control) device. There are multiple commercial products, but there are also open source solutions such as Packetfence.

share|improve this answer
add comment

That could be the "no cost" solution.

There are other switches features like:

  • Port security
  • IP Guard
  • DHCP snooping

And so on.. You should search for "layer 2 security".

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.