Stop unknown pcs connecting to network

DHCP services are desinged to give an address to any machine that send a request.

If you are trying to limit the users I would suggest using a firewall to do it. You can configure some firewalls to require authentication to get out to the internet.

That's about the best you can do to the users. The only other choice would be to use static addresses or reservations and limit the size of the DHCP pool. That would be a royal pain though.

Sorry I don't have a better answer for you.

Good luck.

you could filter by mac address but the administrative effort and cost wouldn't be worth it. Would have to go dig up the W2K Exam 70-220 text book for MAC address filtering in DHCP to give you the hows but, as long as this is a domain, computers that are not members of the domain the can not access resources in the domain. You'll see a workgroup listed in my network neighborhood but thats it.
They won't be able to get to the internet even though they are on the same subnet provided that you run a proxy like ISA server or some other security measure that only allows specific members of a group internet access.

thanks for these answers.

My main concern is unknown PCs connecting to the network and bringing in viruses and spreading on to our network. I want to stop anyone not specifically authorized and approved from even getting on our network.

Turn off DHCP.

Set up your segments so that they do not have more address space available than is currently being used (none of the 255.255.255.0 stuff).

Only turn on switch ports that have been approved for activation.

Deploy network gear that allows you that kind of control. You have invested in that technology, haven't you?

Keep a log of the addresses being used and statically address your nodes.

The idea behind DHCP was (originally) to provide a way for machines that physically moved to be easily connectable to the network so that you didn't have to map switch ports to specific IP addresses, it was not really intended for mass implementation in the way it is done today.

For student networks we make a reservation for all Student PCS and not allow dynamic dhcp. So anyone cannot get an ip address if its not reserved. It is more work but it is secure...

I use a little bit different approach for such problem. We have manageable switches in our network. You can configure a managable switch for port based security settings to allow a specific MAC address and block for others. In case some one try to unplug existing PC and plug something else the port gets blocked and you have to manually reopen that port.
Wish you good luck.
Bye.

Hi Nate,

What you're looking at is called endpoint protection, and is a booming business. It only allows endpoints to come into the LAN which are 'trusted' (e.g. correct AV scanner and patch level), and otherwise redirects them to a quarantaine zone where if you want so they can get the right AV level.

The usual approach involves relatively expensive black boxes, either Cisco gear (their protocol being called NAT) or 802.1x compatible gear. 802.1x comes from the WiFi world but is useful in a broader sense.

In your (budget) case I'd go for a cheaper, but very cleverly designed, route using the DHCP servers. The main vendor I know of is Sygate (now merging with Symantec), and the tool is the 'LAN Enforcer' which is part of Sygate Enterprise Protection.
LAN Enforcer sits in front of the standard DHCP server that you have. When an endpoint asks for a DHCP lease, it first gets one in the quarantaine zone from Enforcer. Then Enforcer has the endpoint checked (AV level etc.) because it should have the SEP agent installed which does this for you. If 'red flag', endpoint remains in quarantaine zone forever. If 'green flag', then Enforcer contacts the real DHCP server and asks for a lease which is then passed on to the endpoint. Now only it can work fully in the school LAN.

Note that LAN Enforcer/SEP will cost you money, but contrary to the hardware-based models it does not need any changes in your black boxes.

Regards,

- The Netherlands

This question was closed by the author