3

I manage a reasonably small network (150 machines or so). We have a DHCP server set up with reservations for all of the machines on the network and an exclusion zone set up over the entire range so that only known machines will get an IP address and hence network access.

However, this practice is hoping for security by obscurity.

It is possible that by plugging a foreign device with its own configured IP address, other machines can get on the network.

Is there any way to prevent this? Is there any way to get machines on the network to ignore traffic from a computer that has not been assigned an address by DHCP?

Improve this question
4
  • Why not bind the mac address of each machine at switch level? So it doesn't matter if they just plug themselves in, they won't get any network access at all.
    – AliGibbs
    Jul 19, 2012 at 12:14
  • MAC addresses can be forged
    – MichelZ
    Jul 19, 2012 at 12:14
  • @AliGibbs Another issue is some of the devices are wireless which means a whole lot of configuring.
    – Philip
    Jul 19, 2012 at 12:15
  • You got some nice answers, but it really would help a lot if you describe a scenario you a trying to protect yourself from. I mean, unauthorized internet access is one thing, a dedicated attacker downloading corporate data is another.
    – Art Shayderov
    Jul 19, 2012 at 15:24

5 Answers 5

Reset to default
7

You should start looking at 802.1x, this is "Network authentication" on Switch level. Basically every machine which gets plugged in has to authenticate itself first before it is allowed to the network.

Have a look here for a tutorial

Improve this answer
2
  • The problem with 802.1x is that it's primarily a LAN access mechanism - it does that job well - but does not accomodate WAN/VPN access control / encryption. OTOH the technologies which do the latter also work at the LAN level. This goes beyond the scope of the original question - but worth bearing in mind.
    – symcbean
    Jul 19, 2012 at 12:19
  • True. Ideally he would have 802.1x, IPSec and all that stuff
    – MichelZ
    Jul 19, 2012 at 12:27
2

Short answer is no.

Depending on your DHCP server you should be able to restrict allocations by mac address - but it's trivial to sniff the mac addresses already on the network and change the address on a particular machine. But this is still more effort than just setting the IP address directly.

If you want to secure your network, use secure protocols and proper authentication.

Improve this answer
2

It is possible that by plugging a foreign device with its own configured IP address, other machines can get on the network.

Yes, very easily.

Is there any way to prevent this? Is there any way to get machines on the network to ignore traffic from a computer that has not been assigned an address by DHCP?

Well yes, you can just have a firewall in-between set to deny all but the allowed IP range.

That said there are other ways of doing this, you could firewall based on a list of MAC addresses, this is slightly more secure than by IP but not much, if it's really important to you then you deed some form of encrypted certificate-driven solution such as setting up a VPN between accepted devices and the inside of your network. This is a very commonly used scenario, especially in organisations that have open wifi networks and is far from cutting-edge.

Improve this answer
2

It sounds like what you're looking for is called Network Access Control or Network Access Protection software. Especially if 802.1x auth at the switch level, as suggested by MichelZ is insufficient for your needs. (Though, I'd look at setting up a RADIUS server or w/e before shopping around for NAC solutions.)

Cisco has a version, Microsoft has a version (in Server 2008, called NAP), as do many third party vendors and computer security/AV companies. [Full disclosure, I used to work for a software development shop that makes such a product.]

Having said that, security is all about doing a cost/benefit analysis around risk. Really, the "ideal" security system is one that's more expensive to breach than what it's protecting, not an "impenetrable" system (unless you're protecting something that's "priceless," of course, then impenetrability would be the ideal).

So before buying (or even implementing a "free") security solution, you should be considering what return you'll get on your investment of time and/or money. (Or, if you're lucky, maybe that decisions' on your boss, or someone else.) Just like it doesn't make sense to buy a $10,000 safe to protect a few hundred bucks, it might not be worth your investment in time or money to establish proper NAC/NAP security, if the risk is low and/or the data you're protecting isn't particularly valuable.

Improve this answer
1

That too is security by obscurity. An attacker could listen for broadcasts, get a valid MAC address from some 'good' computer, and after it's been turned of, use the 'good' mac to get a valid IP address from DHCP.

What you wish, could be implemented by some custom software which would check with the DHCP and alter firewall rules accordingly, or by having a mac filter on each machine, and update the 'good' mac list every time a new box is added (big PITA for the admins).

If you have managed 802.1x capable switches, I would recommend looking into that, or setting up port security, thus allowing port traffic only from specific MACs.

Improve this answer
4
  • "only from specific MACs." - do you think MAC addresses can't be spoofed?
    – symcbean
    Jul 19, 2012 at 12:16
  • Yes, but you have to know the allowed MAC first. You cannot just connect to a random ethernet port on the hallway and listen to broadcasts to gather valid MACs, to spoof one of them. Not great security, but better then nothing. And even after that, you must have access to the correct port for that MAC, so you have to connect from the correct office (since the switches are usually locked up somewhere in some serverroom/closet).
    – mulaz
    Jul 19, 2012 at 12:23
  • Sure, just disconnect one port and connect it to "your" switch, then listen for the MAC that sits on the other end of the cable. Voilà, you've got MAC + valid Port
    – MichelZ
    Jul 19, 2012 at 12:26
  • If you can disconnect ports, you either have access to the office (then you have access to the PC too, so no need to spoof the MAC), or you have access to the switches (so, again, no need to spoof the mac). This seems alot like one of those university setups, where you have a bunch of ethernet ports all around, hallways, lobbies, ... and just want to allow the employees to use the network. 802.1x is the "correct" answer here, but this is still better then relying on "not-getting-IP-from-DHCP".
    – mulaz
    Jul 19, 2012 at 12:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .