ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP)

    IT Discussion
    11
    214
    18.7k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DustinB3403D
      DustinB3403 @scottalanmiller
      last edited by

      @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

      @dustinb3403 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

      To get to a fully static setup, you could begin with DHCP reservations, and simply start saving entries. Once everything has a static assignment, disable DHCP handouts and go from there.

      In any case, you'll be touching every device.

      That seems like too much work. Just assign staticly one by one in a range that isn't in the DHCP range.

      That would require creating/editing the scope(s) (this of course assuming he's not using most of the existing DHCP scope)

      1 Reply Last reply Reply Quote 0
      • scottalanmillerS
        scottalanmiller @dave247
        last edited by

        @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

        @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

        @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

        @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

        @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

        @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

        @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

        I should say that I'm not really judging you or your experience, etc. This whole audit thing is just bizarre to me.

        This is par for the course. Most security audits are scams. If your team knew security, you'd not need an audit. So by the nature of paying someone to do an audit, they pretty much assume that they can take advantage of the situation. All of the money is in that scam.

        Well I'm at a bank, and the banks are under the various banking cartel systems and so we have imposed on us the need for these audits and stuff.

        I worked for a bank and we didn't have that. We had internal auditors, and we'd kick them out for incompetence. They'd literally demand that we do things like shut down the connections to the NY Stock Exchange claiming it was an "unneeded link."

        Well, I'm still new to banking and IT (only 1.6 years now or something) so I am still learning how it all works. I'm sure it's all FUBAR but hey, I got a family to feed.

        That's why I'm pushing you to figure out where you fit into the equation. At some point, you just follow orders and don't worry about it. Sure, post here, ask what a good solution would have been so that you learn options or whatever. But in a case like this, boss says listen to auditor, auditor tells you to burn the company to the ground, you burn it to the ground because your job is to follow the boss' orders.

        It is what it is. But it sounds like the bank has decided that the boss' whims are a higher priority than security or efficiency. It is what it is. BUt that's what they want.

        Here is an early Christmas present: Additionally, the auditors have suggested having phones on their own VLAN for security. SO now I'm trying to set up LLDP.

        Of course they did.

        Any chance these auditors happen to sell support services, too?

        dave247D 1 Reply Last reply Reply Quote 1
        • dave247D
          dave247 @scottalanmiller
          last edited by

          @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

          @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

          @dustinb3403 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

          To get to a fully static setup, you could begin with DHCP reservations, and simply start saving entries. Once everything has a static assignment, disable DHCP handouts and go from there.

          In any case, you'll be touching every device.

          Yeah I'm thinking of that too.. probably the best way to do it and it's still basically static mapping..

          Where "basically" means "not". No reason to mess around with this, it only creates extra work and puts you at risk.

          Why tho? Instead of manually mapping it at the end point, I can do it from the DHCP server.

          scottalanmillerS coliverC 2 Replies Last reply Reply Quote 0
          • DustinB3403D
            DustinB3403 @dave247
            last edited by

            @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

            @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

            @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

            @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

            @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

            @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

            @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

            I should say that I'm not really judging you or your experience, etc. This whole audit thing is just bizarre to me.

            This is par for the course. Most security audits are scams. If your team knew security, you'd not need an audit. So by the nature of paying someone to do an audit, they pretty much assume that they can take advantage of the situation. All of the money is in that scam.

            Well I'm at a bank, and the banks are under the various banking cartel systems and so we have imposed on us the need for these audits and stuff.

            I worked for a bank and we didn't have that. We had internal auditors, and we'd kick them out for incompetence. They'd literally demand that we do things like shut down the connections to the NY Stock Exchange claiming it was an "unneeded link."

            Well, I'm still new to banking and IT (only 1.6 years now or something) so I am still learning how it all works. I'm sure it's all FUBAR but hey, I got a family to feed.

            That's why I'm pushing you to figure out where you fit into the equation. At some point, you just follow orders and don't worry about it. Sure, post here, ask what a good solution would have been so that you learn options or whatever. But in a case like this, boss says listen to auditor, auditor tells you to burn the company to the ground, you burn it to the ground because your job is to follow the boss' orders.

            It is what it is. But it sounds like the bank has decided that the boss' whims are a higher priority than security or efficiency. It is what it is. BUt that's what they want.

            Here is an early Christmas present: Additionally, the auditors have suggested having phones on their own VLAN for security. SO now I'm trying to set up LLDP.

            OK just fire the auditors. We have plenty of proof at this point that they are insane.

            1 Reply Last reply Reply Quote 1
            • coliverC
              coliver @dave247
              last edited by

              @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

              LLDP

              That's not for security.

              1 Reply Last reply Reply Quote 0
              • dave247D
                dave247 @scottalanmiller
                last edited by

                @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                I should say that I'm not really judging you or your experience, etc. This whole audit thing is just bizarre to me.

                This is par for the course. Most security audits are scams. If your team knew security, you'd not need an audit. So by the nature of paying someone to do an audit, they pretty much assume that they can take advantage of the situation. All of the money is in that scam.

                Well I'm at a bank, and the banks are under the various banking cartel systems and so we have imposed on us the need for these audits and stuff.

                I worked for a bank and we didn't have that. We had internal auditors, and we'd kick them out for incompetence. They'd literally demand that we do things like shut down the connections to the NY Stock Exchange claiming it was an "unneeded link."

                Well, I'm still new to banking and IT (only 1.6 years now or something) so I am still learning how it all works. I'm sure it's all FUBAR but hey, I got a family to feed.

                That's why I'm pushing you to figure out where you fit into the equation. At some point, you just follow orders and don't worry about it. Sure, post here, ask what a good solution would have been so that you learn options or whatever. But in a case like this, boss says listen to auditor, auditor tells you to burn the company to the ground, you burn it to the ground because your job is to follow the boss' orders.

                It is what it is. But it sounds like the bank has decided that the boss' whims are a higher priority than security or efficiency. It is what it is. BUt that's what they want.

                Here is an early Christmas present: Additionally, the auditors have suggested having phones on their own VLAN for security. SO now I'm trying to set up LLDP.

                Of course they did.

                Any chance these auditors happen to sell support services, too?

                YES HOW DID YOU KNOW

                1 Reply Last reply Reply Quote 2
                • DashrenderD
                  Dashrender @scottalanmiller
                  last edited by

                  @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                  @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                  @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                  @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                  This might be one instance where you say "Nope, this is a stupid requirement and does nothing for us, obviously this auditor is stupid and has no idea what they're talking about."

                  Problem is, it matches what his boss claims, I think he said.

                  It matches exactly what his boss claims.

                  So back to my "it's all about politics" problem. Can't point out security problems because of politics.

                  Sure, but this doesn't imply that the boss is complicit, much more likely... they failed the audit in the past, they were told that static IPs allow the checkbox to be checked and nothing else. So the boss just continues to run with that info - it's no different than people building RAID5 systems 20 years ago because they were told that's what you do (not understanding the why), and they just kept on doing that.

                  scottalanmillerS 1 Reply Last reply Reply Quote 0
                  • scottalanmillerS
                    scottalanmiller @dave247
                    last edited by

                    @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                    @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                    @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                    @dustinb3403 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                    To get to a fully static setup, you could begin with DHCP reservations, and simply start saving entries. Once everything has a static assignment, disable DHCP handouts and go from there.

                    In any case, you'll be touching every device.

                    Yeah I'm thinking of that too.. probably the best way to do it and it's still basically static mapping..

                    Where "basically" means "not". No reason to mess around with this, it only creates extra work and puts you at risk.

                    Why tho? Instead of manually mapping it at the end point, I can do it from the DHCP server.

                    Yes, but static means not being able to do that. Static means one thing and only one thing. DHCP or Static, there is no DHCP and static. If you use DHCP, you aren't static no matter how you look at it. The D in DHCP is Dynamic, meaning "not static."

                    dave247D 1 Reply Last reply Reply Quote 2
                    • coliverC
                      coliver @dave247
                      last edited by coliver

                      @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                      @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                      @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                      @dustinb3403 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                      To get to a fully static setup, you could begin with DHCP reservations, and simply start saving entries. Once everything has a static assignment, disable DHCP handouts and go from there.

                      In any case, you'll be touching every device.

                      Yeah I'm thinking of that too.. probably the best way to do it and it's still basically static mapping..

                      Where "basically" means "not". No reason to mess around with this, it only creates extra work and puts you at risk.

                      Why tho? Instead of manually mapping it at the end point, I can do it from the DHCP server.

                      Because it's still be handed an address instead of knowing what address it's supposed to have. It's still using DHCP as an addressing mechanism and thus doesn't fulfill the audit's requirements.

                      1 Reply Last reply Reply Quote 0
                      • dave247D
                        dave247 @scottalanmiller
                        last edited by

                        @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                        @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                        @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                        @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                        @dustinb3403 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                        To get to a fully static setup, you could begin with DHCP reservations, and simply start saving entries. Once everything has a static assignment, disable DHCP handouts and go from there.

                        In any case, you'll be touching every device.

                        Yeah I'm thinking of that too.. probably the best way to do it and it's still basically static mapping..

                        Where "basically" means "not". No reason to mess around with this, it only creates extra work and puts you at risk.

                        Why tho? Instead of manually mapping it at the end point, I can do it from the DHCP server.

                        Yes, but static means not being able to do that. Static means one thing and only one thing. DHCP or Static, there is no DHCP and static. If you use DHCP, you aren't static no matter how you look at it. The D in DHCP is Dynamic, meaning "not static."

                        yeah but it's static in that DHCP hands out the same IP to only that system based on mac address and it won't hand an address out to some ding-dong plugging his shitbook into the wall anus

                        DustinB3403D scottalanmillerS 2 Replies Last reply Reply Quote 0
                        • DashrenderD
                          Dashrender @scottalanmiller
                          last edited by

                          @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                          @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                          I should say that I'm not really judging you or your experience, etc. This whole audit thing is just bizarre to me.

                          This is par for the course. Most security audits are scams. If your team knew security, you'd not need an audit. So by the nature of paying someone to do an audit, they pretty much assume that they can take advantage of the situation. All of the money is in that scam.

                          So you don't believe in outside audits at all? People can make mistakes you know, and it not be on purpose.

                          scottalanmillerS coliverC 2 Replies Last reply Reply Quote 0
                          • scottalanmillerS
                            scottalanmiller @Dashrender
                            last edited by

                            @dashrender said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                            @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                            @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                            @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                            @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                            This might be one instance where you say "Nope, this is a stupid requirement and does nothing for us, obviously this auditor is stupid and has no idea what they're talking about."

                            Problem is, it matches what his boss claims, I think he said.

                            It matches exactly what his boss claims.

                            So back to my "it's all about politics" problem. Can't point out security problems because of politics.

                            Sure, but this doesn't imply that the boss is complicit, much more likely... they failed the audit in the past, they were told that static IPs allow the checkbox to be checked and nothing else. So the boss just continues to run with that info - it's no different than people building RAID5 systems 20 years ago because they were told that's what you do (not understanding the why), and they just kept on doing that.

                            The boss separately stated this, though.

                            1 Reply Last reply Reply Quote 0
                            • DustinB3403D
                              DustinB3403 @dave247
                              last edited by

                              @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                              @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                              @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                              @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                              @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                              @dustinb3403 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                              To get to a fully static setup, you could begin with DHCP reservations, and simply start saving entries. Once everything has a static assignment, disable DHCP handouts and go from there.

                              In any case, you'll be touching every device.

                              Yeah I'm thinking of that too.. probably the best way to do it and it's still basically static mapping..

                              Where "basically" means "not". No reason to mess around with this, it only creates extra work and puts you at risk.

                              Why tho? Instead of manually mapping it at the end point, I can do it from the DHCP server.

                              Yes, but static means not being able to do that. Static means one thing and only one thing. DHCP or Static, there is no DHCP and static. If you use DHCP, you aren't static no matter how you look at it. The D in DHCP is Dynamic, meaning "not static."

                              yeah but it's static in that DHCP hands out the same IP to only that system based on mac address and it won't hand an address out to some ding-dong plugging his shitbook into the wall anus

                              DHCP will still hand out addresses to any device that connects to the "wall anus". Unless you had filtering in place where only MAC addresses that were white listed could pull an IP address.

                              But in how the question is worded, they don't care about what the client has, they are asking you "Is your network statically assigned, if not you fail?"

                              stacksofplatesS DashrenderD 2 Replies Last reply Reply Quote 0
                              • scottalanmillerS
                                scottalanmiller @Dashrender
                                last edited by

                                @dashrender said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                I should say that I'm not really judging you or your experience, etc. This whole audit thing is just bizarre to me.

                                This is par for the course. Most security audits are scams. If your team knew security, you'd not need an audit. So by the nature of paying someone to do an audit, they pretty much assume that they can take advantage of the situation. All of the money is in that scam.

                                So you don't believe in outside audits at all? People can make mistakes you know, and it not be on purpose.

                                Yes, but only in extreme cases and only when you really, REALLY know why you are doing it and REALLY know the firm that is doing it and REALLY ensure that you have proper alignment.

                                DashrenderD 1 Reply Last reply Reply Quote 1
                                • coliverC
                                  coliver @Dashrender
                                  last edited by

                                  @dashrender said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                  @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                  @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                  I should say that I'm not really judging you or your experience, etc. This whole audit thing is just bizarre to me.

                                  This is par for the course. Most security audits are scams. If your team knew security, you'd not need an audit. So by the nature of paying someone to do an audit, they pretty much assume that they can take advantage of the situation. All of the money is in that scam.

                                  So you don't believe in outside audits at all? People can make mistakes you know, and it not be on purpose.

                                  Which is why you have teams of people working on IT infrastructure. One person isn't a viable department.

                                  dave247D scottalanmillerS 2 Replies Last reply Reply Quote 0
                                  • dave247D
                                    dave247 @coliver
                                    last edited by

                                    @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                    @dashrender said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                    @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                    @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                    I should say that I'm not really judging you or your experience, etc. This whole audit thing is just bizarre to me.

                                    This is par for the course. Most security audits are scams. If your team knew security, you'd not need an audit. So by the nature of paying someone to do an audit, they pretty much assume that they can take advantage of the situation. All of the money is in that scam.

                                    So you don't believe in outside audits at all? People can make mistakes you know, and it not be on purpose.

                                    Which is why you have teams of people working on IT infrastructure. One person isn't a viable department.

                                    Yes yes yep mmhmm

                                    coliverC 1 Reply Last reply Reply Quote 0
                                    • coliverC
                                      coliver @dave247
                                      last edited by

                                      @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                      @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                      @dashrender said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                      @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                      @coliver said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                      I should say that I'm not really judging you or your experience, etc. This whole audit thing is just bizarre to me.

                                      This is par for the course. Most security audits are scams. If your team knew security, you'd not need an audit. So by the nature of paying someone to do an audit, they pretty much assume that they can take advantage of the situation. All of the money is in that scam.

                                      So you don't believe in outside audits at all? People can make mistakes you know, and it not be on purpose.

                                      Which is why you have teams of people working on IT infrastructure. One person isn't a viable department.

                                      Yes yes yep mmhmm

                                      I was a one man shop not too long ago. Not worth the time and aggravation.

                                      1 Reply Last reply Reply Quote 0
                                      • stacksofplatesS
                                        stacksofplates @DustinB3403
                                        last edited by stacksofplates

                                        @dustinb3403 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                        @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                        @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                        @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                        @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                        @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                        @dustinb3403 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                        To get to a fully static setup, you could begin with DHCP reservations, and simply start saving entries. Once everything has a static assignment, disable DHCP handouts and go from there.

                                        In any case, you'll be touching every device.

                                        Yeah I'm thinking of that too.. probably the best way to do it and it's still basically static mapping..

                                        Where "basically" means "not". No reason to mess around with this, it only creates extra work and puts you at risk.

                                        Why tho? Instead of manually mapping it at the end point, I can do it from the DHCP server.

                                        Yes, but static means not being able to do that. Static means one thing and only one thing. DHCP or Static, there is no DHCP and static. If you use DHCP, you aren't static no matter how you look at it. The D in DHCP is Dynamic, meaning "not static."

                                        yeah but it's static in that DHCP hands out the same IP to only that system based on mac address and it won't hand an address out to some ding-dong plugging his shitbook into the wall anus

                                        DHCP will still hand out addresses to any device that connects to the "wall anus". Unless you had filtering in place where only MAC addresses that were white listed could pull an IP address.

                                        But in how the question is worded, they don't care about what the client has, they are asking you "Is your network statically assigned, if not you fail?"

                                        Not if there is no pool set. If you just do reservations nothing outside of those will get an address

                                        1 Reply Last reply Reply Quote 0
                                        • scottalanmillerS
                                          scottalanmiller @dave247
                                          last edited by

                                          @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                          @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                          @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                          @scottalanmiller said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                          @dave247 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                          @dustinb3403 said in Best way to secure DHCP so that not just anyone can plug their PC in and get an IP? (Windows DC with DHCP):

                                          To get to a fully static setup, you could begin with DHCP reservations, and simply start saving entries. Once everything has a static assignment, disable DHCP handouts and go from there.

                                          In any case, you'll be touching every device.

                                          Yeah I'm thinking of that too.. probably the best way to do it and it's still basically static mapping..

                                          Where "basically" means "not". No reason to mess around with this, it only creates extra work and puts you at risk.

                                          Why tho? Instead of manually mapping it at the end point, I can do it from the DHCP server.

                                          Yes, but static means not being able to do that. Static means one thing and only one thing. DHCP or Static, there is no DHCP and static. If you use DHCP, you aren't static no matter how you look at it. The D in DHCP is Dynamic, meaning "not static."

                                          yeah but it's static in that DHCP hands out the same IP to only that system based on mac address and it won't hand an address out to some ding-dong plugging his shitbook into the wall anus

                                          That's not what static means in IT in any way. You can state that all that you want, but to the end device it is dynamic, not statically set. You'd fail any audit and if you got caught, this would be easily a reason to fire you for intentional insubordination. You cannot make the claim that anything using DHCP is "static". DHCP is the replacement for static, not another static option.

                                          I understand why you want to present it this way, but it IT this isn't an option. You cannot call it that. You are misunderstanding the use of the term static here.

                                          In networking...

                                          "Static IPs" means permanent IPs set on the client device that cannot be modified externally through protocols like BOOTP or DHCP.

                                          If BOOTP or DHCP is involved, it's not static, it's that simple.

                                          1 Reply Last reply Reply Quote 1
                                          • NerdyDadN
                                            NerdyDad
                                            last edited by

                                            Okay sure, go ahead. I get it. Don't even consider my solution. I see how it is. Thanks,

                                            coliverC scottalanmillerS 2 Replies Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 7
                                            • 8
                                            • 9
                                            • 10
                                            • 11
                                            • 9 / 11
                                            • First post
                                              Last post