iPhones in my DHCP

[Jawloms]

Morning,

 

We now have two Wi-Fi networks, one is for our devices and so obviously has access to the network (DHCP handled by Windows server), the other is BYOD and only has access to the Internet (DHCP handled by Fortigate firewall). I have a few iPhones which for whatever reason are on the wrong one. They spoof their MAC address so I can't just "Deny" them in DHCP. One of my tech's found a reddit page saying that DHCP accepts wildcards and spoofed MACs all have a second character of either 2, 6, A, or E, but genuine MACs never do. I've added 02*, 12*, 22*, up to F2*, and then 06* and up, 0A* and up, and 0E* and up to Deny in DHCP but they're still happily renewing their IP addresses. DHCP doesn't show me their names either unfortunately as their typically called helpful things like "Carol's phone".

 

Any thoughts on how I boot these off?

 

Thank you

 

Stuart

[Oaktech]

They must be connected by the wifi... Sounds like a job for Radius for your own devices.

[NegativeKillDeath]

Do you have an incorrectly configured AP that isn't applying the correct VLAN to the BYOD SSID allowing it to leak to the main DHCP?

[Jawloms]

They must be connected by the wifi... Sounds like a job for Radius for your own devices.

 

Ideally yes, but we're not there yet.

 

Do you have an incorrectly configured AP that isn't applying the correct VLAN to the BYOD SSID allowing it to leak to the main DHCP?

 

Nope, they're all controlled by Ruckus. Plus if that was the case my Deny rules in DHCP should stop them getting an IP shouldn't they?

[NegativeKillDeath]

Do you see the MAC addresses connected to any of the Ruckus APs? Is it possible someone has plugged in a consumer grade router/ap somewhere to try and get internet access?

[Jawloms]

The MAC addresses in Ruckus are the same as in my Windows DHCP server. No rogue APs, but again even if they had, why are they getting an IP from my DHCP server when my Denies are in place?

[NegativeKillDeath]

Getting the deny rules working isn't addressing the problem that non school devices are talking to the wrong DHCP server. Looking at Ruckus you will be able to see which SSID the clients are connecting to, if they are on your device SSID then there is something wrong with that SSIDs authentication, if they are on your BYOD SSID then there is something wrong with client isolation or VLANS.

[Jawloms]

It's a lot simpler than that. They've just been added to the wrong network by people. That aspect of it is not a technical issue.

[Davit2005]

Private/Random MAC addresses rather than spoofed???

 

 

https://www.mist.com/get-to-know-mac-address-randomization-in-2020/

[Olliedawg]

Im sure Private IP address is enabled by default on iOS devices, so that would be the case

[NegativeKillDeath]

A bit of reading suggests that IOS keeps the same private MAC for each wifi profile it has. What I am having trouble finding out is how Windows DHCP server handles requests from previously leased clients. Is it possible that it will continue to allow the client to renew its lease and the deny filter will only kick in when the lease is no longer valid?

[dmj]

The DHCP server/mac addresses seem like a red herring to me, that unauthorised clients can access a server on the network (the DHCP) is a symptom of a misconfiguration, not the cause.

 

To address it, as @Oaktech correctly points out, you need to configure your RADIUS server to only accept known clients onto the internal network that also authenticated as a user. It sounds like you are using user authentication but you need to authenticate users and known devices onto that network.

[Jawloms]

A bit of reading suggests that IOS keeps the same private MAC for each wifi profile it has. What I am having trouble finding out is how Windows DHCP server handles requests from previously leased clients. Is it possible that it will continue to allow the client to renew its lease and the deny filter will only kick in when the lease is no longer valid?

 

This is what I'm wondering too.......