preventing users from dropping wireless onto the lan

[Jim]

Archived from groups: microsoft.public.windows.networking.wireless (More info?)

We have many lan subnets that are giving dhcp out

I'm afraid that users may bring in one of their home airport express
devices (or the like) and drop them on the network, so now they have
unsecured wireless.

Obviously this is a security risk. Is there some resonable way to
prevent this?

Thanks

 

[Guest]

Archived from groups: microsoft.public.windows.networking.wireless (More info?)

Some access points have 'rogue AP detection' (e.g. Proxim) that could detect
such a thing and send an SNMP alert.

You can restrict your DHCP servers to only give IP addresses to known MAC
addresses, or put restrictions on some DHCP parameters. For example, the
built-in Windows DHCP client sends 'MSFT ...' as vendor string. It is
unlikely that an AP would send that, so you can refuse an answer in that
case

Or you can try the polite way: hang up a sign saying "Please don't connect
your home airport express devices to my LAN..."


"jim" <jim@cogentit.com> wrote in message
news:b2d9j0dpucicu6ql35vlufspijon5up98q@4ax.com...
>
> We have many lan subnets that are giving dhcp out
>
> I'm afraid that users may bring in one of their home airport express
> devices (or the like) and drop them on the network, so now they have
> unsecured wireless.
>
> Obviously this is a security risk. Is there some resonable way to
> prevent this?
>
> Thanks

 

[Jim]

Archived from groups: microsoft.public.windows.networking.wireless (More info?)

We have a acceptable user policy that includes this kind of thing, and
it is common knowlege that it is not "OK", but nobody cares. (except
me)

We would have a very difficult time with MAC address restriction, but
I will check the rougue AP detection. Any links would be appreciated

Thanks



On Tue, 31 Aug 2004 19:34:48 +0200, "Jeroen van Bemmel"
<someone@somewhere.com> wrote:

>Some access points have 'rogue AP detection' (e.g. Proxim) that could detect
>such a thing and send an SNMP alert.
>
>You can restrict your DHCP servers to only give IP addresses to known MAC
>addresses, or put restrictions on some DHCP parameters. For example, the
>built-in Windows DHCP client sends 'MSFT ...' as vendor string. It is
>unlikely that an AP would send that, so you can refuse an answer in that
>case
>
>Or you can try the polite way: hang up a sign saying "Please don't connect
>your home airport express devices to my LAN..."
>
>
>"jim" <jim@cogentit.com> wrote in message
>news:b2d9j0dpucicu6ql35vlufspijon5up98q@4ax.com...
>>
>> We have many lan subnets that are giving dhcp out
>>
>> I'm afraid that users may bring in one of their home airport express
>> devices (or the like) and drop them on the network, so now they have
>> unsecured wireless.
>>
>> Obviously this is a security risk. Is there some resonable way to
>> prevent this?
>>
>> Thanks
>

 

[Guest]

Archived from groups: microsoft.public.windows.networking.wireless (More info?)

http://www.proxim.com/learn/library/whitepapers/Rogue_Access_Point_Detection.pdf

"jim" <jim@cogentit.com> wrote in message
news:c0e9j0hg84fl3753ff0bvoenpfaqlo9e3g@4ax.com...
> We have a acceptable user policy that includes this kind of thing, and
> it is common knowlege that it is not "OK", but nobody cares. (except
> me)
>
> We would have a very difficult time with MAC address restriction, but
> I will check the rougue AP detection. Any links would be appreciated
>
> Thanks
>
>
>
> On Tue, 31 Aug 2004 19:34:48 +0200, "Jeroen van Bemmel"
> <someone@somewhere.com> wrote:
>
>>Some access points have 'rogue AP detection' (e.g. Proxim) that could
>>detect
>>such a thing and send an SNMP alert.
>>
>>You can restrict your DHCP servers to only give IP addresses to known MAC
>>addresses, or put restrictions on some DHCP parameters. For example, the
>>built-in Windows DHCP client sends 'MSFT ...' as vendor string. It is
>>unlikely that an AP would send that, so you can refuse an answer in that
>>case
>>
>>Or you can try the polite way: hang up a sign saying "Please don't connect
>>your home airport express devices to my LAN..."
>>
>>
>>"jim" <jim@cogentit.com> wrote in message
>>news:b2d9j0dpucicu6ql35vlufspijon5up98q@4ax.com...
>>>
>>> We have many lan subnets that are giving dhcp out
>>>
>>> I'm afraid that users may bring in one of their home airport express
>>> devices (or the like) and drop them on the network, so now they have
>>> unsecured wireless.
>>>
>>> Obviously this is a security risk. Is there some resonable way to
>>> prevent this?
>>>
>>> Thanks
>>
>