|
||||||||||
On Fri, Oct 01, 2010 at 05:54:49PM -0400, Jewell, Michael wrote: > It doesn't have to be an expensive managed switch, there are other more cost effective ways. > > But it's not realistic to believe that adding a Router/Firewall like m0n0 will be able to turn your cheap Linksys/DLink/Netgear/<Insert generic brand here> switch into an all encompassing solution. Cisco's are expensive switchs because of the features they offers because it's manageable. If you really want to prevent users from being able to screw with the system, as I see it, there's a couple basic ways: > > 1, buy a managed switch, lock the mac to a sticky port. I would add: 1b, buy a decent managed switch used (eg, ebay); you can get excellent hardware for very little money. If you just need 100Mbit, HP procurve 26xx is dirt cheap; if you need Gbit, then the 28xx doesn't cost much more. Like any good managed switch, these can also do all kinds of other fancy security measures such as snooping dhcp and/or arp packets, and preventing machines from using any ip address other than that assigned by your dhcp server; or per port web authentication similar to the m0n0wall captive portal, and so on. > 2, buy a second switch, add a 3rd nic to your m0n0, put that user on their own little vlan where it doesn't matter what mac they use, if they're plugged into that 2nd switch, they will always be bound by the firewall rules on that opt interface. > 3, buy a semi managed switch (like a cheap web managed switch) and configure a second vlan for that user and configure vlan's on m0n0 with an opt interface. > 4, Forcing all your users thru an authenticated web proxy will prevent the user from going to someone else's desk to get to the internet. > > Rules by mac don't work since you can change the mac easy. > Rules by ip don't work if they change the mac or ip. Graham -- ------------------------------------------------------------------------- Graham Allan - I.T. Manager - allan at physics dot umn dot edu - (612) 624-5040 School of Physics and Astronomy - University of Minnesota ------------------------------------------------------------------------- |