Restrticted DHCP server list - KiXtart.org - official site

You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Lounge » Restrticted DHCP server list

Page 1 of 1

1

Topic Options

#137977 - 2005-04-14 03:22 PM Restrticted DHCP server list
Richard H. Richard H. Administrator Registered: 2000-01-24 Posts: 4946 Loc: Leatherhead, Surrey, UK	Does any one know of a method to restrict a DHCP client to only accept responses from authorised servers? I have an issue where our users are not allowed to use their corporate laptops on home networks. Needless to say a number of them are ignoring the policy. As a start, I'd like to restrict them so that they only accept DHCP configuration from the corporate DHCP servers. All pointers gratefully accepted.
Top

#137978 - 2005-04-14 03:36 PM Re: Restrticted DHCP server list
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Don't you keep a pointy stick behind your door? You could consider one of a few approaches. 1. Put a LGPO logon script on them that checks HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, "DhcpDomain" (untested) 2. Sniff the DCHP requests going to the server cuz the machine will always try to renew the last IP it had. 3. If the laptops don't roam to other subnets, you could give them fixed IPs. 4. If they do roam but always use the same DNS, you could fix the DNS setting. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#137979 - 2005-04-14 03:44 PM Re: Restrticted DHCP server list
AzzerShaw AzzerShaw Seasoned Scripter Registered: 2003-02-20 Posts: 510 Loc: Cheltenham, England	This isnt possible to do, as the client will always just look out for a address and will get it from wherever address are being broadcasted. Maybe you can just increase the lease time of the address, so when they go home it wont try to re-register (not tested mind) Aaron _________________________ If at first you don't succeed, try again. Then quit. There's no use being a damn fool about it. - W.C Fields
Top

#137980 - 2005-04-14 04:02 PM Re: Restrticted DHCP server list
Richard H. Richard H. Administrator Registered: 2000-01-24 Posts: 4946 Loc: Leatherhead, Surrey, UK	Beating them up after the event will be a pleasure, however I'd rather make it hard for them in the first place. I may have to resort to popping up a window if I find it's on an authorised subnet, and frighten them into submission. I'm also considering shutting down the interfaces if I don't like the network, and providing a method of allowing the user to bypass the restriction with a passkey that they will have to telephone the support department to get. the passkey will of course be based on the subnet / DHCP server. BTW I'm not sure fixing the DNS will work - I had to do something similar recently, and the DNS server value from the DHCP server was appended to end of the static DNS server list.
Top

#137981 - 2005-04-14 04:04 PM Re: Restrticted DHCP server list
Richard H. Richard H. Administrator Registered: 2000-01-24 Posts: 4946 Loc: Leatherhead, Surrey, UK	Quote: Maybe you can just increase the lease time of the address, so when they go home it wont try to re-register (not tested mind) No, that won't work. The DHCP server will just send a NACK and the client PC will start the DHCP request process from start.
Top

#137982 - 2005-04-14 04:14 PM Re: Restrticted DHCP server list
AzzerShaw AzzerShaw Seasoned Scripter Registered: 2003-02-20 Posts: 510 Loc: Cheltenham, England	Then sorry dude, i think your down the creek without a paddle. Unless of course you use a static address. _________________________ If at first you don't succeed, try again. Then quit. There's no use being a damn fool about it. - W.C Fields
Top

#137983 - 2005-04-14 04:14 PM Re: Restrticted DHCP server list
Richard H. Richard H. Administrator Registered: 2000-01-24 Posts: 4946 Loc: Leatherhead, Surrey, UK	Just had a lightbulb moment. We may be able to use IPSEC: Block all source addresses unless the destination is one of our public addresses. Allow all traffic when the source address is one of out internal addresses. This would have the effect of allowing unrestricted access when the PC is on one of our intranets. When the PC is on a foreign network only our public sites will be allowed. Hmmm... possibilities here...
Top

#137984 - 2005-04-14 05:41 PM Re: Restrticted DHCP server list
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	ROFL Quote: We may be able to use IPSEC I just had the same thought! Scary _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#137985 - 2005-04-14 05:58 PM Re: Restrticted DHCP server list
Gargoyle Gargoyle MM club member Registered: 2004-03-09 Posts: 1597 Loc: Valley of the Sun (Arizona, US...	How about using a logon script that verifies the IP subnet and if it doesn't match then do a forced logoff? _________________________ Today is the tomorrow you worried about yesterday.
Top

#137986 - 2005-04-14 07:33 PM Re: Restrticted DHCP server list
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11634 Loc: Space	Guess I'm too late for this discussion. I'm having a meeting today on just this topic to setup secure communication using IPSEC for some critical systems that can not run antivirus software. For those interested though, Microsoft has even recently published an article on this very topic as well. Server and Domain Isolation Using IPsec and Group Policy Step-by-Step Guide to Internet Protocol Security (IPSec) Windows XP - Internet Protocol security (IPSec) Might also want to take a look at this page for another possible idea. I've not tested it though for the purposes for which you're looking to do. Configuring ICMP Router Discovery Edited by NTDOC (2005-04-14 10:00 PM)
Top

#137987 - 2005-04-14 11:46 PM Re: Restrticted DHCP server list
masken masken MM club member Registered: 2000-11-27 Posts: 1222 Loc: Gothenburg, Sweden	yeah, IPSec is the way to go when building secure environments. I've been on some seminars on this actually, and it ain't that hard to implement. Just remember that it has about 20-30% of overhead on the network traffic. You can also accomplish alot with 2003 SP1 & WinXP SP2 clients using Firewall GPO's and DHCP client scope planning. Edited by masken (2005-04-14 11:47 PM) _________________________ The tart is out there
Top

#137988 - 2005-04-15 01:25 AM Re: Restrticted DHCP server list
NTDOC NTDOC Administrator Registered: 2000-07-28 Posts: 11634 Loc: Space	Yes there are trade-offs as with most any technology. Much (but not all) of the slower speed has to do with how many filters you use, etc... encryption also slows down the traffic speed. Here is a Microsoft Webcast that goes into some more details. TechNet Support WebCast: How to isolate servers by using Internet Protocol security
Top

#137989 - 2005-04-15 10:29 AM Re: Restrticted DHCP server list
Richard H. Richard H. Administrator Registered: 2000-01-24 Posts: 4946 Loc: Leatherhead, Surrey, UK	The stock MS firewall is not particularly useful in this case. It is designed to stop unsolicted traffic coming in to the PC - outgoing traffic is unaffected. Doc, thanks for the links. I've got a bit of reading to do.
Top

#137990 - 2005-04-15 05:27 PM Re: Restrticted DHCP server list
mole mole Getting the hang of it Registered: 2003-01-01 Posts: 81 Loc: Indian Head, Maryland, USA	There is an interesting less technical explanation of IPSec posted on AnalogX: http://www.analogx.com/contents/articles/ipsec.htm Part way down that page is an IPSec template you can download that I've used and found it an effective learning device to get the feel for how to configure IPSec. This is certainly an often overlooked aspect of securing Windows that deserves more attention. mole _________________________ mole Who is John Galt?
Top

Page 1 of 1

1

Previous Topic

Previous Topic View All Topics

View All Topics

Index Next Topic

Next Topic

Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart

Hop to:

Shout Box

Who's Online

0 registered and 847 anonymous users online.

Newest Members

fgarcia, Viginette, ManuvdWielNL, Sir_Barrington, batdk82
17889 Registered Users

Generated in 0.066 seconds in which 0.025 seconds were spent on a total of 12 queries. Zlib compression enabled.

click tracking