Working on a network at an high rise apartment complex. They have a core router/firewall acting as dhcp server and about 7 switches (all l3 switches). They have a few vlans to segment traffic based of a few things; one of them being speed tiers. My company took over this network about a week ago.

So far one of the issues I’ve seen is that they don’t use any MAC address limiting. This has been an issue because residents are plugging in WiFi routers which are forbidden on the network due to us provided WiFi via APs. DHCP snooping is active but that won’t keep them from using these routers.

My question is are there any options other then what I’ve mentioned to keep users from being able to use unknown home routers?

I read a bit recently about changing the IP packet TTL = 1 so the home router drops on traffic returning back on the LAN which would be great. I haven’t found a way to get this working with the topology I have. Seems the ttl method is mostly used when routing between multiple routers using routing protocols. If I can get that method to work then it be a Win for me.

Do you know how I can get this to work with just 1 router, and layer 3 switches??

closed as off-topic by Ron Maupin Mar 9 at 18:06

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Unfortunately, questions about home networking and consumer-grade devices are explicitly off-topic here. You could try to ask this question on Super User. – Ron Maupin Mar 9 at 18:06

Why is using a WiFi router a problem for you? Because of DHCP? I don't think that a TTL=1 would fix your problem. You might take a look at VLANs (one VLAN per appartment), or PVLANs (if you need > 4000 VLANs). Another possible solution: Port security and a list of allowed mac addresses per switch port.

Not the answer you're looking for? Browse other questions tagged or ask your own question.