<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Arptables comes to mind but can also be circumvented using MAC spoofing.<br></div><div><br>On Jan 29, 2015, at 1:45 PM, Patrick Trapp <<a href="mailto:ptrapp@nex-tech.com">ptrapp@nex-tech.com</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Yeah, the initial focus is to prevent accidental connections. I'm sure what you suggest here is a future discussion.<br>
<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF6429"><font color="#000000" face="Tahoma" size="2"><b>From:</b> <a href="mailto:dhcp-users-bounces@lists.isc.org">dhcp-users-bounces@lists.isc.org</a> [<a href="mailto:dhcp-users-bounces@lists.isc.org">dhcp-users-bounces@lists.isc.org</a>] on behalf of Jason Gerfen [<a href="mailto:jason.gerfen@gmail.com">jason.gerfen@gmail.com</a>]<br>
<b>Sent:</b> Thursday, January 29, 2015 10:53 AM<br>
<b>To:</b> Users of ISC DHCP<br>
<b>Subject:</b> Re: Restricting leases<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">
<div class="gmail_default" style="font-family:verdana,sans-serif; font-size:small">
No problem. Also so you are aware, if you want security on said subnet/network segment the previous use of hardware matching with classing assigned to each/any subnet you wish to implement this white list of devices with would be further enhanced through the
use authenticated MAC services as this feature within a dhcpd.conf configuration will only prevent known/unknown devices from automatically obtaining a set of configuration options (hostname, ip, gateway, bootp/pxe services) for the given lease.<br>
<br>
A user with some information of the network segment may simply assign these values and then utilize the network.</div>
<br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Jan 29, 2015 at 9:40 AM, Patrick Trapp <span dir="ltr">
<<a href="mailto:ptrapp@nex-tech.com" target="_blank">ptrapp@nex-tech.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>
<div style="direction:ltr; font-family:Tahoma; color:#000000; font-size:10pt">Thanks, Jason. I'm off to educate myself enough to have an intelligent question when I return. ;-)<br>
<br>
Have a great day!<br>
<br>
<div style="font-family:Times New Roman; color:#000000; font-size:16px">
<hr>
<div style="direction:ltr"><font color="#000000" face="Tahoma"><b>From:</b> <a href="mailto:dhcp-users-bounces@lists.isc.org" target="_blank">
dhcp-users-bounces@lists.isc.org</a> [<a href="mailto:dhcp-users-bounces@lists.isc.org" target="_blank">dhcp-users-bounces@lists.isc.org</a>] on behalf of Jason Gerfen [<a href="mailto:jason.gerfen@gmail.com" target="_blank">jason.gerfen@gmail.com</a>]<br>
<b>Sent:</b> Thursday, January 29, 2015 10:26 AM<br>
<b>To:</b> Users of ISC DHCP<br>
<b>Subject:</b> Re: Restricting leases<br>
</font><br>
</div>
<div>
<div class="h5">
<div></div>
<div>
<div dir="ltr">
<div style="font-family:verdana,sans-serif; font-size:small">Good morning Patrick,<br>
<br>
</div>
<div style="font-family:verdana,sans-serif; font-size:small">While the typical RTFM is always encouraged I believe the option(s) that will benefit you the most regarding a wildcard whitelist of nodes per network segment would be the section within the dhcpd.conf
titled 'client classing' & 'subclasses'.<br>
<br>
</div>
<div style="font-family:verdana,sans-serif; font-size:small">The examples provided should give you some insight into allowing devices based on the hardware identifier or other unique device identifiers. More information on these can be obtained in RFC-2132
(<a href="https://www.ietf.org/rfc/rfc2131.txt" target="_blank">https://www.ietf.org/rfc/rfc2131.txt</a>) table 3 (fields and options in a DHCP message).<br>
<br>
</div>
<div style="font-family:verdana,sans-serif; font-size:small">Hope this helps<br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Jan 29, 2015 at 9:12 AM, Patrick Trapp <span dir="ltr">
<<a href="mailto:ptrapp@nex-tech.com" target="_blank">ptrapp@nex-tech.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>
<div style="direction:ltr; font-family:Tahoma; color:#000000; font-size:10pt">First, an apology - I'm not even sure how to ask this question, so my pre-post research really got me nowhere. So I'm really looking for a direction as much as an answer - I hate
wasting people's time asking a question when I don't really know enough to ask the question well.<br>
<br>
Second, the question(s) - Can we/how can we/should we limit the devices that the DHCP server provides addresses to? For example, legitimate devices on this network are 80% produced by two specific manufacturers. There should be virtually no workstations on
this network - legitimate workstations accessing this network will do so via another network and get their addresses from a different DHCP system. The only reason a workstation should be on this network is if a technician is troubleshooting.
<br>
<br>
So I am looking at the viability of allowing devices from the known manufacturers and whitelisting the specific devices carried by our technicians and not providing addresses for unexpected devices.<br>
<br>
I fully expect and deserve an RTFM - I'm hoping someone can give me some ideas where I should be looking and what key words will get me where I need to go.<br>
<br>
Thanks for reading,<br>
Patrick<br>
</div>
</div>
<br>
_______________________________________________<br>
dhcp-users mailing list<br>
<a href="mailto:dhcp-users@lists.isc.org" target="_blank">dhcp-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/dhcp-users" target="_blank">https://lists.isc.org/mailman/listinfo/dhcp-users</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
_______________________________________________<br>
dhcp-users mailing list<br>
<a href="mailto:dhcp-users@lists.isc.org" target="_blank">dhcp-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/dhcp-users" target="_blank">https://lists.isc.org/mailman/listinfo/dhcp-users</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>dhcp-users mailing list</span><br><span><a href="mailto:dhcp-users@lists.isc.org">dhcp-users@lists.isc.org</a></span><br><span><a href="https://lists.isc.org/mailman/listinfo/dhcp-users">https://lists.isc.org/mailman/listinfo/dhcp-users</a></span></div></blockquote></body></html>