New Sophos Support Phone Numbers in Effect July 1st, 2023

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Prevent IP Address Assignment via MAC Addr

Hello,

I found this 12 year old thread,

 Block certain mac address to get ip from dhcp pool 

and would like to know if it is now possible to prevent the assignment of IP addresses to specific MAC addresses.

Thanks



This thread was automatically locked due to age.
Parents Reply Children
  • Thanks for clarifying. Unfortunately, specifying their MAC under Advanced didn't prevent the hosts from being assigned an IP address:

  • either you can put the computer on a vlan/subnet that doesn't have a DHCP server on it. Don't enable DHCP Relay for that subnet and you're fine. Or, just assign a static IP

    Thanks & Regards,
    _______________________________________________________________

    Vivek Jagad | Team Lead, Global Support & Services 

    Log a Support Case | Sophos Service Guide
    Best Practices – Support Case


    Sophos Community | Product Documentation | Sophos Techvids | SMS
    If a post solves your question please use the 'Verify Answer' button.

  • put the computer on a vlan/subnet that doesn't have a DHCP server on it.

    Good idea but these are unknown hosts (I can't find them) so I can't change their configuration.

    Other than running another DHCP server on the VLAN, is there a way to restrict their MAC addresses to the VLAN on the UTM side?

  • I created a VLAN:

    And a DHCP server on the VLAN interface (Unknown):

    Static mappings for the unknown hosts in the Unknown address space:

    And they are still receiving an IP address from my production DHCP server:

    Blocking hosts shouldn't be this difficult. Ubiquiti can do it with three clicks...

  • either you can put the computer on a vlan

    How does one put a computer on a vlan in this context?  He would need to be using a a switch that does mac based vlan assignments (a cheap netgear gs308t does this). I'm not sure how this is possible otherwise if the clients in question are on the same lan segment.

    Simply defining a vlan in UTM is insufficient. Client needs to be placed on that vlan by some means - either mac based vlan switch, or vlan definition in the client nic settings. Unless i'm missing something, just defining a vlan in utm does nothing for the above considerations.

    Using mac based vlan is quite simple.  Assign client to a undefined vlan - that is a vlan which has no services available. Client will never get an ip, nor be able to access any other part of the lan.

    Blocking by firewall isn't optimal either as that doesn't affect other mechanisms such as web proxy, which will allow access.

    Toggling Clients with static mappings only in the UTM dhcp server setting achieves what the OP is after, so long as all other connected clients have been defined in UTM. Unknown clients get no dhcp assignment. This is a bit of using a sledge hammer on a picture nail type solution. What happens when a new unknown client is connected.... it won't have any network services.


    OP's request seems quite simple, yet there doesn't appear to be an elegant simple solution of literally just not assigning an IP to a matched MAC.

    Depending on the size of your network, it may work best to flip the logic and enable the static mappings toggle in the dhcp server. This will effectively assign IP's to defined clients and block all unknown.

    Or, perhaps more detail with respect to why you're trying to block these clients?

  • Good idea but these are unknown hosts (I can't find them) so I can't change their configuration

    We do it the other way 'round. Any unknown MAC goes into a quarantaine VLAN wihn no further network or internet access (we use the wireless hotspot for this it also works on wired networks). Better for security.

  • ^^How are you doing this?  What determines the mac going in to the quarantine vlan?

  • Toggling Clients with static mappings only in the UTM dhcp server setting

    Great suggestion, thank you! I will give this a try.

    more detail with respect to why you're trying to block these clients?

    The hosts are unknown. I'm hoping that blocking them will cause them to cease functioning, revealing which hosts they are, AND to prevent the unnecessary use of my 50 IP address allocation.

  • tThe static mappings option will work then.  In testing, if no other dhcp server (you can have *multiple dhcp servers for the same interface so long as their ip assignments don't overlap) exists for the given interface then the device is not assigned any ip at all and defaults to a 169.xxx which goes nowhere.

    I'm using this arrangement to assign specific ip's to known devices, and other ip's within the same subnet to unknown devices.

    For known devices:

    For unknown devices:

    Why?  Unknown devices get different web filtering settings applied than known devices.

    Note! The above will not work for ipv6 if using slaac/stateless assignment. Some mechanism of setting vlan will need to be used to block them so the device requests never reach UTM in the first place.

    I'm looking forward to reading how  implements the mac quarantine scheme.

  • Great suggestion, thank you! I will give this a try.

    Woo-hoo, it worked!