Block unauthorized user from getting access to intranet

Question

What's the common way to block users from accessing intranet?

Right now, whoever plugs in a cable can access any intranet server freely. I want to change this behavior. But given that we run not only Windows machines but also Linux clients, I can't just use NAP to restrict DHCP access.

Here's my thoughts:

1. Perhaps all users should do a AD authentication before granting him network access. But that's not integrated with the router.
2. Checked allowed MAC addresses from a white list. But the perpetrator could just listen for traffic then collect authorized MAC address and use them later.

What should I do now? Any mature product?

Answer 1

There are different ways of tackling this:

1. Disable unused ports (which should obviusly be the first line of defense)
2. Using port security on your switch makes it at least necessary that an attacker finds out a certain MAC address and connects to a specific port, which will stop most people from plugging their home devices into the company network. In addition to this you may activate a "suspend" mode for ports: The 1st time an invalid MAC address is detected on a port it will shut down and has to be reactivated manually by an admin.
3. Radius would obviously the most fitting solution for your problem. You can configure your Windows DC as a radius authentication server and then have your switches forward the authentications request using 802.1X. The result would be that anybody trying to access the network would have to enter their username and pw used on the DC. If it is not correct they will be isolated in a separate restrictive VLAN. Disadvantage: You need hardware that supports 802.1X and have to understand VLAN concepts. I will not go into details of RADIUS here. If you are interested feel free to ask.

Answer 2

Ideal setup is to treat employees differently and the outsiders who come to office differently.All the employees should be put on a different network in a different firewall zone say trust(10.2.0.0/16) and the outsiders on another network on another firewall zone say trust2 (10.3.0.0/16)

You can provide access to the internet from trust and then whitelist the IP addresses as and when required from trust2(you should provide static addresses). This will give you better flexibility to on the policies for the organization (for eg: if you want to give unrestricted internet access to employees and block certain sites from non employees)

Coming to NAP, I have not worked on it.But after some reading, it seems that Microsoft partners have released NAP clients for linux and MAC. (http://kurtsh.com/2008/12/23/info-network-access-protection-nap-clients-for-linux-and-macintosh-are-available/)

I do not have prior experience using any of these clients, hence cannot comment on them, but you can make inquiries.They seem like commercial tools

If you are looking for non commercial tools, there is a possibility of using squid.Squid can prompt users for a username and a password.

http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch32_:_Controlling_Web_Access_with_Squid#Password_Authentication_Using_NCSA

http://www.cyberciti.biz/tips/linux-unix-squid-proxy-server-authentication.html

Yet another option would require help from your firewall.I have worked on Juniper Netscreens and they allowed authentication on the rule.So basically you configure authentication on the firewall rule that allows internet access and users will have to enter a username and password to get through.This is device dependent and you will need to check your firewall for such a feature.

Answer 3

Just disable unused ports on the switch, on this way if the attacker plugs in a cable it won't connect to the intranet because that port was disabled.

Obviously, if he unplugs some device and plugs its device there, he can connect to the intranet. But in this point get in the game another question, how is your physical security?

Answer 4

NAP would be your best bet and is available for Linux and Mac clients. You can also "register" devices that do not have NAP capability manually or mostly automated with a portal page. Either way, you should, as others have pointed out, work on your physical security if users are able to freely unplug machines.