1

I have a network with 500+ computers, at my area there is lots of cooperation companies that sometimes bring their own routers. If they do it in sneaky way and do not turn off DHCP service on the device many devices get wrong addresses and it takes long time to find it. Is there any solution?

I thought of isolating department or building with VLANs with separate subnets. I thought also of using static arp on main switches and put entry with 192.168.0.1 and 192.168.1.1 to my DHCP. Does it make sense, will it secure address changes in any way?

4
  • 1
    You want switches with DHCP guard. And VLANs. And 802.1x.
    – womble
    Nov 2 '15 at 9:03
  • @womble First time heard of DHCP guard, can you explain? Is it a one of the manufactuer features?
    – galq
    Nov 2 '15 at 10:00
  • Google is your friend.
    – womble
    Nov 3 '15 at 0:37
  • googled with no revelant result.
    – galq
    Nov 3 '15 at 5:52
3

There is lot of ways how to secure it:

  1. Divide your network to VLANs. You can setup routing between VLANs which have to communicate each other.
  2. Setup internal firewalls to not allow DHCP packets which are not from authorized server (ie. detect it with senders IP)
  3. Use 802.1x to authorization of each client connected to network. This is best solution, but slowest to implement (you need to check and add each device by hand). Of course you can setup this only on accessible ports, servers doesn't need to check this.

There is no silver bullet how to securely avoid bad DHCP servers and don't limit your users, you have to balance it.

1

Explore "DHCP Snooping" technology - it should be available in any enterprise-class switch/router. And yet it is quite simple to configure. What switches do you have?

In relation to what others suggested:

  • 802.1X will prevent the use of the network by all unauthenticated clients, that is those companies.
  • VLANs won't help - at most they will be able to limit the scope of the damage.
  • "Use DHCP firewall" - DHCP Snooping IS this very firewall

BTW: how did you manage to get such pretty big a network?

1
  • It's big mix of manufactures and device class.
    – galq
    Nov 3 '15 at 5:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.