Allowing certain devices to be authenticated

[MordyT]

Back when I was in school, I remember something about a feature in server 2008 r2 that allowed you to only allow certain devices to access the network.

 

Meaning if I took a random PC and plugged it into a active jack, it wouldn't allow it to access any network services/devices.

 

Does anyone remember what this is called so I can do more research?

 

Or is there any alternatives you would recommend?

 

Also looking for a way to prevent known PCs from being able to access the network in the event a student wipes them and reinstalls a blank OS without our restrictions.

[plexer]

Network Access Protection - NAP with 802.1x port security.

 

Ben

[ADMaster]

I've not used this myself but it is another NAC solution to look at.

 

PacketFence: Open Source NAC (Network Access Control)

 

I wish I had time to get a NAC solution going.

[chazzy2501]

there is a Microsoft technology that does not need switch access or new hardware. SDI (Windows Server and Domain Isolation) its built in and free. It uses IPsec to encrypt all the communication so even if a device were to get on the network it can't talk to anything!

[plexer]

Server and Domain Isolation

 

Ben

[plexer]

I guess the drawback with server and domain isolation is that any devices that wish to contact the resources must be domain joined which would rule out most tables and phones but for securing highly important subsections of a domain it's a good idea.

 

Ben

[chazzy2501]

I think with SD&I you can set a no encryption perimeter setup. (Printers, Phones. etc.) This kind of setup may be desirable if you have no control over your network (Rented building with switching as part of your rental) I know of 1 school with that setup

[chazzy2501]

oh and if your going to use 802.1x then there is this useful looking software.

 

Packetfence

 

EDIT: ooops @ADMaster beat me too it

Edited September 16, 2013 by chazzy2501

[MordyT]

Thanks everyone. Its either SDI or NAC... Don't remember, but think its SDI. I have my work cut out for me.