Restrict Access for Non-Domain Users

[jag2050]

Hello Experts,

 

I have citrix enviornment with 2 DC, DNS and DHCP servers with CISCO 3750 switches on default VLAN, currently any one can walk in connect a device to network and get IP from DHCP and can be a part of the network..

 

I am thinking is there a way I can restrict access for all non-domain users.

 

I have a soloution to configure NAC with RADIUS server on my DC i.e. IAS server but its gonna be very complicated in our network...

 

Is there a simple soloution using DHCP or GPO to restrict access to the network for all those users who are not a member of domain?

[sahmeepee]

Sadly DHCP wasn't really made with security in mind. AFAIK, the only way you can really achieve this using DHCP is to give all your clients static IPs/reservations and then assign any "rogue" devices an IP address way out in the nether-lands so that they can't communicate with your managed clients.

 

It's not a 5 minute job!

[srochford]

if you've got a list of your MAC addresses then you could set up reservations for all of them - it's scriptable so you don't have to type them all in :-)

 

One other thing I've read about but never really used is IPSec - you can configure a group policy to say "always use IPSec". Any non-domain PC won't do this so won't be able to talk to the network.

[p858snake]

Just setup security on your server and filtering system so they can't access anything without being identified with their login details?

[sahmeepee]

Just setup security on your server and filtering system so they can't access anything without being identified with their login details?

 

...which works great until viruses like Conficker get cleverer and stop just guessing at weak passwords. Also, you are relying very heavily on none of your machines being even 1 critical Windows update behind. If they are there is a risk that a virus could exploit it and infect the PC regardless of Windows account. Apparently there are even embedded printer OSes being compromised by Conficker.

 

Obviously there are many millions of ways of tackling these problems, but if you can stop rogue devices from being able to send data over your network at all you're putting up a pretty big barrier.