IT Employment

Ask something
Discussion Locked

Segregating a network via MAC Address

0 helpful
2 replies

by bryan.walthall

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm not extremely experienced in network engineering, but I have a security question that relates to it. Is it possible to prevent a PC from going to one LAN and force it to go to another LAN based on a MAC address?

I want to set up a quarantine area where PCs and laptops should attach to in order to be scanned and receive patches prior to tying to the real network. I want to be able to do this before any activity on the real LAN takes place. The only way I can see this is if a system looks at a MAC address access list. If the computer is not on the list, it is sent to the "disinfect" LAN, where scanning and other activities are performed. Once that is done, the PC must reboot. During the reboot process, the access control list is updated to include the PC's MAC address and it is now allowed on the network.

My question is, is there a piece of hardware or software out there that can perform that kind of functionality. Kind of like a firewall and router rolled up into one.

Thanks

2 replies

by lordinfidel

Although I *guess* with enough money and programming time it could be done.

But.... If you are in an AD enviroment, this can all be accomplished via Group Policy.

You can push out updates to a system while it is being booted up. There is no "quarrantine" area though.

The one thing I don't like about what you propose, is that the firewall would have to be able to accept dynamic updates. And that is not something you want happening, ever.

Not to mention that you would have to have a database will all MAC address' of every NIC. This could get very tedious.

Typically, you only filter on MAC address' in router/firewall scenarios. So that IP spoofing is harder to take place.

by ghstinshll

No one currently offers a solution like this that I'm aware of... Most companies are using their login scripts, GPOs, and SMS servers to push updates to the clients as needed. This should be all you need. A good client software reporter would be of use to you like SMS2000 or Altiris Desktop Client to check status of machines when they log in. This will ensure you know every machine is patched or needs patched...

This discussion is closed to new replies.