From owner-freebsd-security@FreeBSD.ORG Mon Apr 5 03:10:05 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9209E16A4CE for ; Mon, 5 Apr 2004 03:10:05 -0700 (PDT) Received: from katase.netgrup.ro (netcom.suceava.astral.ro [213.164.255.90]) by mx1.FreeBSD.org (Postfix) with ESMTP id EB8C943D5C for ; Mon, 5 Apr 2004 03:10:03 -0700 (PDT) (envelope-from ady@freebsd.ady.ro) Received: from freebsd.ady.ro (ady.obcini.netgrup.ro [192.168.10.206]) by katase.netgrup.ro (8.12.10/8.12.10) with ESMTP id i35A9pPs001188 for ; Mon, 5 Apr 2004 13:09:53 +0300 (EEST) (envelope-from ady@freebsd.ady.ro) Date: Mon, 5 Apr 2004 13:09:52 +0300 Mime-Version: 1.0 (Apple Message framework v553) Content-Type: text/plain; charset=US-ASCII; format=flowed From: Adrian Penisoara To: freebsd-security@freebsd.org Content-Transfer-Encoding: 7bit Message-Id: <611C2010-86E9-11D8-A962-000A95776E22@freebsd.ady.ro> X-Mailer: Apple Mail (2.553) Subject: Q: Controlling access at the Ethernet level X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Apr 2004 10:10:05 -0000 Hi, I am searching for a solution that will enable me to control the access of clients to a Ethernet network that spans over about an entire quorter; most of the connected stations are running MS Windows. We are facing service theft through impersonation, either solely IP or both IP and Ethernet MAC address. Securing IP access was solved using a static ARP scheme (we used "staticarp" for the internal gateway interface and tied to it a fixed list of IP/MAC tuples), but some of the clients learnt how to change both the IP and the MAC. We have thought about using static MAC entries per port on managed switches installed at the client endpoints, but that would require a overwhelming budget. We are also thinking about L2TP and PPPoE, but I am uncertain about compatibility. What would you recommand ? Are there any other elegant solutions ? I also heard about 802.1x technology and seems to be an interesting and professional alternative; I just don't know how well supported is on the server side, namely FreeBSD. Thank you. -- Ady (@freebsd.ady.ro)