2

We are setting up a new network at work, when the building was comprised mostly of desktops, life was simple -static IPs for everyone. As the company moved to wireless laptops, they began keeping a DHCP reservation list. For a few dozen laptops this solution, while bulky, was effective. But as we move from a few dozen to a few hundred, this solution becomes even more difficult to manage.

My boss's concern is that he wants only company owned devices authenticated on the internal network, and all the rest to use the 'guest' network (including tablets, mobiles, etc).

What's the best practice for maintaining this type of constraint?

  • There are a couple of different options, but it will probably come down to money. What kind of wireless network do you have? Brand? Controller-based or individual access points? – Ron Trunk May 8 '14 at 16:45
  • We are demo-ing the Meraki cloud managed solution – HashHazard May 8 '14 at 16:59
3

First of all I don't think that static MAC-IP bindings have anything to do with security. MAC addresses can be easily faked and guessing a valid but unused IP for your network and manually assigning that to an interface is not rocket science.

What you are looking for is most probably 802.1x. With 802.1x each client gets a certificate and only those clients with valid certificates are allowed on your network. Other will simply have no access or will be moved to special guest network.

802.1x requires client support (some printers, embedded system, ... might not support it.), a RADIUS Server, network equipment that supports it and a Certificate Authority (CA).

Depending on your needs and hardware you can even "download" access-list to your network equipment and restrict clients even further.

One big warning: Implementing 802.1x is a lot of work, administration and is quite time consuming.

Another solution I've seen is to use no authentication / encryption on your wireless network and then use IPSEC VPNs.

  • Spot on, MAC bindings are trivial to spoof. Relying on that for authentication shouldn't even be considered 'secure' anymore. – Ryan Foley May 8 '14 at 16:51
  • Can I use a solution like this to 'lock' access to company owned devices? – HashHazard May 8 '14 at 16:55
  • Sure. You run the CA you hand out or revoke certificates as you like. If you only want company owned devices only handout certificate to those clients. If one gets stolen revoke the certificate. – Jens Link May 8 '14 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.