Multiple Locations MAC-Filtering

Question

Hi all, 
 hopefully a simple question: Can you centralize the host-lists when using only static mac-mappings for dhcp leases in multiple locations? Basically I set up the DHCP in a testlab to prevent connections of private/unwanted devices. To do so I am using the option "Clients with static mappings only" within the DHCP server settings on a SG115. Working fine. Now we have the simple "problem" that some users are traveling a lot and need DHCP-leases in a random office. A little exaggerated and simplified but pretty close to the truth. So I am looking for a simple solution that I need to implement a change only one time and copy/push/pull them to the other firewalls or similar. Otherwise we would have to take care of more than a dozen sites with regular changes. That would be only a matter of time until something goes wrong even if it is only a mistyped MAC-address. Is there anything like that? I guess the answer is "no" but it doesn't hurt to ask :) Further information: All sites will be connected by site2site IPSEC tunnels. RED tunnels are no viable option.

BAlfson · Accepted Answer

Hallo isard, 
 If I understand what you want to accomplish, I think I would do this differently. Instead of using DHCP with static mappings, put a MAC Address List named "Local Devices" in each site and use that to limit the "Allow" firewall rules to just the MACs in the MAC Address List. Then, you can have identical rules everywhere. To prevent use of Proxies (see #2 in Rulz ), use some method of authentication and block unauthenticated access. Will that do what you want? 
 Cheers - Bob