Subject: RE: [dhcwg] DHCP secure communication

From: "Kostur, Andre" <[email-masked]>
Date: Tue, 2 Jul 2002 07:59:18 -0700

There's a couple of options.  One is RFC 3118 as mentioned by John
Schnizlein.  This would require you to deploy something to every legitimate
client that you have (and have a DHCP server that understands 3118).  A
second option is to do something like register all of the MAC addresses of
your legitimate devices to your DHCP server.  I'm pretty sure most (if not
all) DHCP servers are capable of assigning a particular IP to a particular
MAC.  Some servers allow for a little more flexible mechanism where only
certain MACs may request an address, but are still allocated an address
dynamically (I know Incognito's can).

> -----Original Message-----
> From: Ralph Zimmermann [mailto:[email-masked]]
> Sent: Tuesday, July 2, 2002 1:50 AM
> To: [email-masked]'
> Subject: [dhcwg] DHCP secure communication
> 
> 
> Hi,
> 
> I'm looking for a way to have a secure communication between 
> DHCP server
> and client. One reason is to prevent visitors to our company 
> from plugging in
> their laptops (I know, this should never happen, but ...) 
> configured for DHCP
> and then easily be part of our network.
> 
> A ssh like add-on to client and server would prevent standart 
> DHCP clients from
> obtaining an ip address, as they will not know the right keys 
> to talk to it (so it
> should at least be some shared secret). This would also 
> prevent visitors from
> sniffing the IP multicasts in plain text.
> 
> If there's any know solutions to this, please let me know.
> 
> Many thanks,
> Ralph Zimmermann
> 
> _____________________________________________
> - Network Administrator -
> 
> SALT AG
> Sedanstrasse 23
> D-97082 Würzburg
> 
> Tel:  +49 931 3573 - 400
> Fax: +49 931 3573 - 409
> 
> mailto:[email-masked]
> 
> 
> 
> _______________________________________________
> dhcwg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/dhcwg
>