MAC address filtering in DHCP

[lafleur1977]

Hello,

 

I am trying to stop users from connecting their personal devices to the network as every time they do they are given a DHCP lease. We disconnect unused network ports but some users use the active network ports or wireless network. For the wireless I can probably deny mac addresses on our WLAN controller but I am looking for a more effective method if possible.

 

The DHCP server runs Windows Server 2008 and I am aware that R2 has mac filtering built into DHCP. I have been looking at DHCP Server Callout DLL for MAC Address based filtering (DHCP Server Callout DLL for MAC Address based filtering - Microsoft Windows DHCP Team Blog - Site Home - TechNet Blogs) but have not been able to get this to work successfully using the following syntax:

 

#MACList.txt

MAC_ACTION = {DENY}

#List of MAC Adresses:

0014858b482e #PCNAME

 

Anyone know were I may be going wrong or of any alternatives?

 

Thanks

[Geoff]

This is the wrong tool for this job. You need to use network access control. You have two options.

 

1) Use 802.1X on your network. This requires your switches supporting it, plus some retooling of your DC(s) to support RADIUS and certificate services.

2) Use some sort of network server to control the network access. I have used packetfence in the past successfully. No doubt other edugeekers can offer alternatives.

[lafleur1977]

We actually use Network Policy Server and RADIUS to authenticate wireless devices but have struggled with non network devices which come up with a certificate error when trying to connect. All inherited and I am new to NPS/RADIUS/certificate services. I can see how this would be better in that the device would require the certificate to gain access to the network.

 

Thanks for your reply.

[strawberry]

use DHCP NAP. create a rule denying by mac, then allowing by mac then allowing if the computer account can be found in AD.