Security

Ask something
Discussion Locked

MAC Layer Network Authentication

0 helpful
6 replies

by mark bridges

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Suppose I have a database of all of the NIC MAC addresses on my network. I want only computers with MAC address that I have recorded to gain access to my network. How might I go about identifing a computer that attaches to my network with a MAC address that I have not authorized and not allow it access and/or immediatly turn the port it is trying to connect through off?

Further let's suppose that I don't allow static IP addressing. All address are assigned via DHCP. My ideal solution would be that when a computer (server or client) requests an IP address that I run a check on its MAC layer address, compare it against my database of authorized machines and either grant or deny an IP address and report back attempts to connect non-authorized machines.

6 replies

by joseph moore

A lot of this will be dependant upon the OS of your systems. I will give you the Windows version.

The first question is more difficult, so let's go to the 2nd question first, about DHCP and rejecting intruders from getting a valid IP. In DHCP Manager in Windows (NT and 2K) you can set up Reservations. After you set up your DHCP pool, you can set up individual Reservations, where a single IP from the pool is ALWAYS assigned to a specific MAC address. So, the trick to this is, you create a DHCP pool that is only EXACTLY as large as the total number of client machines you have. You then go and Reserve each IP address in the pool with a MAC.
This way, when you are done, each MAC on your network is assingned its own IP from the DHCP pool, and there are no more IPs left to be assigned to anyone else!

by joseph moore

Ok, onto the first question. I really don't have a good solution for you on this. The Windows Resource Kit has a tool called GETMAC.EXE
This tool gets the MAC address from a remote IP address.
I am thinking that you can use this as a starting point. You would have to monitor your network (maybe do broadcast PINGs every once in a while, and log who responds). Take the responces you get, and run them against GETMAC.
Take the results of THAT comparison and bang it against your MAC database.
If you then get something that does not match, you would then have to send some type of command to the switch to 1) determine the port that MAC is connected to and 2) have the switch deactivate the port.
Now, how do you do all of that? I haven't a clue! I don't know if there are products out there to do this, but you never know.

Good luck

by mark bridges

Thanks for addressing this ... the answer that I have come up with will be based on a monitoring tool recognizing new attachments and comparing addresses via an exit I will write ..

by alpha-male

Regarding the first part, you can configure this in your switch management software. This sort of thing is usually done while creating VLANs to separate up the broadcast domains. If you're working on Cisco Iron, you can use VMPS (VLAN Management Policy Server) to set it up dynamically or manually enter the static VLAN info in the switch IOS. For other switches, you'll have to check your documentation to see if/how it can be handled.

If you set your switch up fo filter by known MAC addresses,you sort of by default fix your second issue. If the MAC address is not recognized in the table, it doesn't get assigned to a VLAN (network) so it can't see the server to be given an IP address. You of course will have to add new MAC addresses when you add a new machine to the network.

Hope this helps....

This discussion is closed to new replies.