Security

Ask something
Discussion Locked

Block an IP Address

0 helpful
12 replies

by poltorakja

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am the Systems Admin for a non-profit school. I have some students or faculty that are placing thier computers on the network. We are not stopping this, but they are setting tier IP Address in the DHCP Range. Every day they change thier addressto impact someone else. I refuse to change my range and would like to know if there is a way to bump that person off the network. Our network is flat. I do not have any equipment to speak of to assist. Just me.

Any help would be great

Jack

12 replies

by beto.uy

You cannot block them from setting IP addresses
to their computers, at least using some computer
system configuration method ;-)

You can try to assign a DHCP range and assign
other range from which the addresses are
picked to set up IP at student o faculty
computer, this is a collaborative method.
Other can be leave the computer which IP
addresses are assigned that way alone in
a separate network, or a network separated
using a router.

This cannot solve your problem, the
solution is a policy to assign IP addresses and
the collaboration to make them succeffull.

by meganetcomputers

What type of equipment do you have on your network such as switches/routers/hubs? How are they gaining access to the network? Are your networking devices managable? If you would like further assistance please contact me.

by meganetcomputers

Do you know if they often connected to the same port or access point within your infrastructure or does it always change?

by meganetcomputers

You can do what you are looking for with the 3550 switch. So the answer to your questions would be solved when you implement the cisco switches. If you need any further assistance please contact me. Below is a better explanation of its features:

The Catalyst 3550-12T can offer enhanced data security through the use of ACLs. By denying packets based on source and destination MAC addresses, IP addresses, or TCP/UDP ports, users can be restricted from sensitive portions of the network. Also, due to the fact that all ACL lookups are done in hardware, forwarding and routing performance is not compromised when implementing ACL-based security in the network.

Network managers can also implement higher levels of data security and boost LAN performance by deploying up to 1005 VLANs per switch. This ensures that data packets are forwarded only to stations within a specific VLAN, creating separate collision domains between groups of ports on the network and reducing broadcast transmission. VLAN trunks can be created from any port using the standards-based 802.1Q or Cisco ISL VLAN trunking architecture. In addition, Private VLAN Edge provides security and isolation between ports on a switch, ensuring that traffic travels directly from its entry point to the aggregation device through a virtual path and cannot be directed to a different port. Local Proxy ARP works in conjunction with Private VLAN Edge to minimize broadcasts and maximize available bandwidth. For superior security management, the Catalyst 3550-12T supports standard and extended access control lists (ACLs) on VLAN ports as well as routed ports.

by jayanth

If these people are using Windows NT/2000, do not give them the Local Admin privileges and set their machines to accept IP from DHCP.

If you deny them the Local Admin privileges on their respective machines, then they will not be able to change thier IP's whenever they desire.

by poltorakja

Wow, I'm impressed with the time it took to answer. Here is a little more info.

On this campus, I have MAC's and PC's. About 250 are the property of the school. These systems play well together. I have DHCP installed and everything is nice.
On this campus, I have Faculty, Staff and Students that are bringing computers on the campus, but we are currently only allowing certain systems on due to the infrastructure and the equipment available. I believe that our Students and some staff are putting their personal systems on the network. That is why the 1st and 3rd comments don't work in this situation due to lack of control.

My infrastructure is 10MB Synoptic Hubs and other 10mb hubs. We are moving into the Cisco 3550 Switches and this should help us. I have no routers, only a PIX Firewall and a bunch of hubs.

I was told of a utility that could shut down a NIC or at least bump it off of the network. I just want them to know that someone know that they are there and we are getting closer.

Again, any help would be great.

Jack

by beto.uy

There is nothing you can do with a NIC from
the network (except in special cases).
If your network have hubs you cannot solve your
problem independently of collaboration from
others. If you change your hubs and connect
ALL IP capable devices toswitches (manageable
and configurable like your's Cisco model),
you can disable the port of a switch where is
connected the device that is diturbing your
network. You can do this only after the problem
have afected your network.

by poltorakja

Thanks for the info. I will wait until the cisco solution is in and then start the process.

Thanks again
Jack

This discussion is closed to new replies.