From: Adam Flinton 

Richard B. wrote:
> I've managed to dodge this headache for a while, but The End Is Near.
>
> The company prez wants a tablet PC and wants pretty much full network
> connectivity from wherever he is as long as there is wired or wireless
> access, i.e., from home, motels, other consultants, etc.
>
> He is NOT a power user, mainly does email and surfs the next as
> needed.  My tech and I have both been to his home and it's the usual
> mess there with spyware and viruses.  Basically I have to assume the
> worst case scenario and defend against it.
>
> I'm thinking of how I can best protect my LAN from him both when he
> connects from outside and when he comes inside, most likely not giving
> us time to thoroughly check his machine before he connects.
>
> Tips?  Resources?  Advice?  Shoot myself now?
>
> - Richard

A) Get the Mac address of the network card(s) in the machine.

B) Set up DHCP to give out info on the basis of Mac addresses You can do it
in reverse i.e. a default for most & the "special set" for
people like him i.e. only keep a list of the mobile machine mac'es. If you
want to be safe, do it for all machines & make the dhcp only give out
ip addr'es if the mac is on one of the lists (i.e. mobile/fixed or
trusted/not trusted).

C) The DHCP setting for him/mobile devices sets the machine up in a
separate ip numbering system with a box given as a gateway (both to the
inet & the local lan).

D) Filter/firewall that eth device on the gateway.

You can do this for all "road warrior" laptop/mobile devices.



Adam

--- BBBS/NT v4.01 Flag-5