aimal
| [HELP] Internet restriction in LAN
hi,
i want to configure my LAN so that only those PCs which are registered in Domain and are logged through Domain can access the internet and LAN resources, the rest of the users which are logged to their PC as local user should not be able even to get IP from DHCP and use static IP given manually to their PC for accessing any thing on the LAN. |
|
aryoba
Premium,MVM
join:2002-08-22
| Are you referring to MS Active Directory Domain? If yes, then the management setup you are looking for should be centralized on the Domain Controller. In addition, you may need external authentication server such as RADIUS to restrict which destination IP addresses certain users can or cannot access. |
|
Euphrates
join:2007-04-30
Bellingham, WA
| reply to aimal
Well, I believe you could configure Active Directory to issue only a certain block of ip ranges to Active Directory computers and then have the DHCP Server (probably running on the DC) issue out another range of ip addresses to "other" computers not a part of Active Directory. Once done, then the configuration on the router is a simple access list denying internet access to the non-Active Directory range of ip addresses.
This is a quick and dirty solution, but should work. However, because it isn't relying on Active Directory on the router side, it can be bypassed. |
|
joecool42069
@rr.com | reply to aimal
802.1x(wired or wireless), dynamic vlans with VMPS, Cisco NAC... to name a few, though 802.1x sounds like it fits your scenario best. |
|
