2

Is there a way for me to set up DHCP so that only domain devices get an IP Address from a certain subnet, say 192.168.12.x, and other non-domain devices would be assigned to a different subnet?

Edit: I'm currently running Windows Server 2008.

3

DHCP on its own isn't capable of this. YaRi's answer doesn't do anything to separate the networks - if you plug a non domain system in to a domain assigned VLAN port you would be on the wrong network.

You could maintain a list of MAC addresses for your domain systems and base your ranges on this (if you aren't in the list, you aren't included in the domain IP range).

If you are serious about this what you really need is a device designed for network access control and supporting the 802.1x protocol. That is probably overkill.

  • Our switches can't handle 802.1x and I don't think funding for it is in the near future, so assuming that I go with the first option: I'd have a fixed scope of IP addresses that matches the number of domain devices (maybe a few more for future devices) and have MAC-address filtering to prevent other devices from connecting. Would I then have another scope for the non-domain devices, and how would I prevent a domain device from getting an IP address from the general IP address pool? Thanks for answering! – fzlogic Jan 8 '15 at 22:05
  • @fzlogic - if you are trying to retrofit an existing infrastructure you can use the windows firewall and IPSec to segment off your domain systems. – Tim Brigham Jan 8 '15 at 22:08
  • Do you know of any good guides that show how to do this? – fzlogic Jan 8 '15 at 22:33
  • Assigning IP by MAC for the domain devices is the right answer for a small network. It's simple, it works, ant it gives the effect of static IP addresses for those devices. – Bob Brown Jan 9 '15 at 0:32
3

DHCP alone can't do this. However, this can be easily accomplished using NAC (with DHCP pools). NAC (Network Access Control) establishes a network "vestibule" where higher level processes can be applied to move the device into another zone, apply patches, or AV updates, or any number of things. You can spend as much on NAC as you want, but a decent NAC for small businesses is built into windows 2008. In about an hour you can have enough setup to give temporary IP's on a dmz lan for foreign machines, while giving IP's on a private lan for Domain machines.

1

Yes, you need VLANs. VLAN == subnet. Then set up DHCP scopes and IP address pools for each VLAN.

  • Thanks for answering, unfortunately our switches aren't capable of doing VLANs. – fzlogic Jan 8 '15 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.