2

We are setting up a new network at work, when the building was comprised mostly of desktops, life was simple -static IPs for everyone. As the company moved to wireless laptops, they began keeping a DHCP reservation list. For a few dozen laptops this solution, while bulky, was effective. But as we move from a few dozen to a few hundred, this solution becomes even more difficult to manage.

My boss's concern is that he wants only company owned devices authenticated on the internal network, and all the rest to use the 'guest' network (including tablets, mobiles, etc).

What's the best practice for maintaining this type of constraint?

Improve this question
2
  • There are a couple of different options, but it will probably come down to money. What kind of wireless network do you have? Brand? Controller-based or individual access points?
    – Ron Trunk
    May 8, 2014 at 16:45
  • We are demo-ing the Meraki cloud managed solution
    – HashHazard
    May 8, 2014 at 16:59

1 Answer 1

Reset to default
3

First of all I don't think that static MAC-IP bindings have anything to do with security. MAC addresses can be easily faked and guessing a valid but unused IP for your network and manually assigning that to an interface is not rocket science.

What you are looking for is most probably 802.1x. With 802.1x each client gets a certificate and only those clients with valid certificates are allowed on your network. Other will simply have no access or will be moved to special guest network.

802.1x requires client support (some printers, embedded system, ... might not support it.), a RADIUS Server, network equipment that supports it and a Certificate Authority (CA).

Depending on your needs and hardware you can even "download" access-list to your network equipment and restrict clients even further.

One big warning: Implementing 802.1x is a lot of work, administration and is quite time consuming.

Another solution I've seen is to use no authentication / encryption on your wireless network and then use IPSEC VPNs.

Improve this answer
3
  • Spot on, MAC bindings are trivial to spoof. Relying on that for authentication shouldn't even be considered 'secure' anymore.
    – Ryan Foley
    May 8, 2014 at 16:51
  • Can I use a solution like this to 'lock' access to company owned devices?
    – HashHazard
    May 8, 2014 at 16:55
  • Sure. You run the CA you hand out or revoke certificates as you like. If you only want company owned devices only handout certificate to those clients. If one gets stolen revoke the certificate.
    – user2084
    May 8, 2014 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.