Re: Blocking at firewall via MAC address

["Jeffrey Macko" <jeffrey () macko net>]

I assume you're aware that many network cards allow you to key the MAC
address in the config.  So it's really not a good solution.   Heck, if you
ping the machine, and then arp the MAC address it's rather easy to obtain
the "token".

Also, when the packet is routed, IP packets don't have MAC addresses.  So
unless you're attempting to block the laptop from communicating with a
device on the local subnet, you're out of luck.

Perhaps a VPN or some kind of cert for auth would be a better choice?

----- Original Message -----
From: "B. Scott Harroff" <Scott.Harroff () att net>
To: <>
Sent: Thursday, December 13, 2001 11:10 AM
Subject: [fw-wiz] Blocking at firewall via MAC address


> A business parter has a security requirement that only pre-identified and
> approved laptops (identified by MAC address acting as a physical token)
can
> access a network behind a firewall.  Identification and blocking by IP
> address alone is not acceptable as it could be too easily changed by a
user
> to match the IP address of an approved machine.
>
> This could be done by placing a smart switch that only allows cerain MAC's
> on certain ports to communicate with the firewall.  The other (cost
> preferable) option would be to have the firewall block communications from
> all but machines with approved MAC and IP addresses.
>
> Does anyone have a soltion on how to block via MAC address with OpenBSD?
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () nfr com
> http://list.nfr.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards