Security

Ask something
Discussion Locked

Static IP Security

0 helpful
15 replies

by ranwinz_57

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I was recently made aware of a large LAN that uses static IP addressing rather than DHCP. The reason given was that static IPs provide more security than DHCP. I've never heard this before and can't myself think of any reason why this should be so. Can anyone explain it to me?

15 replies

by wls

I suspect that there are various services that are run from well known places on the network. They most likely use that knowledge in order to clamp down the firewall around certain boxes.

by keyboard kowboy

If a company has a network setup with static IPs, neither of these IPs are routeable. Which is good because outside networks can't access any clients within the network (ie: file servers). Also it doesn't cost anything.

by davidpmartin

Static IPs providing more security than DHCP? If anything, it is the other way around. If a company was to use DHCP and provide constant release and renewal of DHCP leases, unless a bad guy had a sniffer on the network all the time, it would be hard to guess which client uses which IP address.

In fact, using Static IPs all the time does not make sense from a security standpoint, especially if you do not have a firewall. The internet is constantly being scanned, and if a Static IP is being used, its that much easier for a hacker to come back and try to exploit the ports on static IPs.

My rule - use a firewall, of course, but all clients get DHCP by default, and all servers are put on static IPs - the static IPs for the servers areonly because we require permanant address translations through the firewall because services required by computers connecting to us through our firewall from the outside.

Static IPs everywhere? - sounds like a LAN administrator that needs job security :-)

Dave Martin, CSS1, CCNP, CCDP, MCSE, Network+
System and Network Engineer, SAIC

by keyboard kowboy

"Static IPs everywhere? - sounds like a LAN administrator that needs job security :-)"

Where did that come from?

by davidpmartin

Was a little humor aimed at the LAN admin who recommended static IPs everywhere - for a large network I can't EVEN imagine doing this. Sorry if you don't have my same sence of humor

by sbnetsec

I had a case with DHCP where a vendor came to my organization and pluged in his laptop and grabbed an IP address and did so many thing in my LAN.
But with static IP any visitor will come to you first and ask.
That's the only case I experienced.
Ihope this help.
Raymond
www.sbnetsecurity.com

by james r linn

I used to work for a huge telecommunications company. They used, ay least until I left, static addresses.

Thinking was that with so many spare jacks, so many contractors, temps etc., security inside the network was potentially a problem. And of course they had been exploited previously both in their voice and data networks.

It also helped them control internal groups which put up their own servers onto the network, forcing them to put them into data centres.

But for those of us who hadto travel site to site it was a big pain.

James

by davidpmartin

I guess this would work - but why what the person able to -- do things on your LAN? -- unless you were using an OS that did not require authentication on everything. As hostile as the IT world (esp the internet is becoming), I cannot imagine not having a secure NT, W2K, or Secured UNIX OS as the foundation for the LAN. I have had people use DHCP on my network to grab IPs - but they were unable to do anything else because the could not authenticate to the domain. If you really want to lock you LAN down, then use port security at a Cisco Switch based on MAC addresses. That way you will know even when a computer is moved to another port.

by a_albua

I totally agree with you. In general static and dynamic both have their advantages and disadvantages but that's not all the security issues you can consider in a network. DHCP is always prefered the question is if you can not afford a cisco switch how would you authenticate users while you're using Windows only environment? In my case any visitor to the company would plug his laptop and get access to the Internet for free which we don't like since the user is not defined anywhere... What programs can authenticate users while keeping high performance network. MS Proxy Server in most of the cases is slow because it does other things like filtering sites etc...

by envisionone

Hell I didn't even think about that one. Now all I need to do is manually configure the layer 2 ports on the catalyst to match them with their mac addresses. Is there anyway this can be done automatically? Either by auto-sensing at the switch or something? Thanks for the great idea.

by sbnetsec

One of the problems a sophisticated visitor can do in your LAN when using DHCP is he can use Network traffic analyzer to collect your users passwords and other sensitive info.
-
Implement a security policy (no visitor is allowed to use his own laptop without a permission from IT dept.)

My solution will be using private IP (workstations) and NAT or a switch.

--www.sbnetsecurity.com--

by micky martins

Large network using DHCP server. The bad guys smuggles in a lap and plugs it in the network and attack the original DHCP server and when it goes down the dhcp server on his lap start assigning ip address to all the dhcp clients

If you have firewall that protects your network within this range of ip address 192.168.0.1 - 192.168.255.254 and lap start assigning ip address from 172.16.0.0 - 172.31.255.255 then you have a security problem.

As you can see, there are more security issues if this happens because DHCP server can assign dhcp client with ip address of default gateway, win server, dns server.

by butterflyrocket

DHCP sure does make it easy to manage workstations... If you want to increase your security, then run static Ip's. That way, you're able to better control who can get on your network...

For even greater levels of paranoia, you can switch your network and run Vlan's on top of that... Keep each subnet isolated to limit breakins...

by davidpmartin

Provided you have the right Catalyst IOS, it's a snap.

at the enable level type in the following:

set port security 2/1 enable 00-90-2b-03-34-08

-00-90-2b-03-34-08 is the mac address for this example but it could be any mac address you wanted

- if you don't want to get this paranoid, you can set it for a maximum number of max addresses such as:

Console> (enable) set port security 7/7 maximum 3

What happens when more than 3 people try to use port 7/7, or in the earlier case where the mac address is not 00-90-2b-03-34-08? The user who is attempting to use a bogus mac address gets locked out - and has to come to the system administrator to unlock that port.

This is a pain to set up, but it doesn't get much more secure than this - if your goal is to prevent unauthorized people to go in and just plug into the network.

I got the commands off the Cisco web site, and have actually done this in a production environment - works pretty good!

Hope this helps

by rameshchock

In a network where they nee to give external access, they may prefer static IPs for a few systems. So they may have chosen Static Ip rather than DHCP.

This discussion is closed to new replies.