Problems with students Spoofing Mac's and taking IP addresses on a school network. (long in details)

[Rickinajijic]

I'm the I.T. Director and I work for a school (7th-12th grade) in Mexico (read as "little to no budget") When I was hired in they had;

150 students and about 50 staff member in the school, all use the Wi-Fi network. The students and/or staff bring their own laptop, Kindle, Macintosh, IPAD, Cell phones (or whatever they have) to use on the network. On these devices for O.S.'s we have Win XP, Vista, Win 7, Win 8, Win 8.1, Macintosh (four flavors) They had 4 servers for administrative needs set up with DHCP (not served out statically) no one could find the servers so they stopped using them. (no possibility of running a true domain on the network)

They had two Telmex (DLS modems) running DHCP with the same gateway (172.168.1.254 YUP!) plugged into the network both running DHCP and serving out the same IP pool range. from 172.168.1.100 to 172.168.1.250. (150 IP's served out with a 4 day lease time)
Each student and teacher/staff had at least one laptop one cell phone and a few had an IPAD also. So when I come they had approximately 450 to 480 devices on this network fighting for the 150 IP's with a 4 day lease. Needless to say this did not work well and they had been dealing with it over 3 years.

It was a flat network with 9 A.P.'s for all connections with the exception of 24 wired connections for administrative needs.
24 wired connections to one 24 port unmanaged switch. 10/100/Gig
6 A.P.'s on a 16 port unmanaged switch. 10/100/Gig
3 A.P.'s on another 16 port unmanaged switch. 10/100
All of this was set up by a "network architect" from Guadalajara Mexico and I inherited the network this way.) I was given no password for any device or server as the school did not keep the records very well.

I reset and reconfigured all A.P.'s and reloaded the servers and gained access to all. I set the IP's on the A.P.'s and server in the range of 172.168.1.2 to 172.168.1.30 I hard coded the IP's in the servers and mapped network drives on admin computers.

I installed a "TP Link TL-R470Tt+" Load balancing DSL firewall, router, Gateway to get rid of the two Gateways and double the internet download speeds (I did shut of the DHCP on this device).
I installed "OpenDHCP" on one server to serve out IP's by MAC to IP to User. This way I can see what student is causing problems in the logs.

The servers and administration personnel are on the 172.168.1.X network
The students are on the 172.168.2.X network
The teacher/administration Cell Phone are on the 172.168.3.X network
Here is what the config looks like:
Domain=172.168.1.0
Mask=255.255.0.0
#Admin/Staff
DHCP Range =172.168.1.30 - 172.168.1.250
#Students
DHCP Range =172.168.2.1 - 172.168.2.250
#Cell Phones
DHCP Range =172.168.3.1 - 172.168.3.250

[01-23-45-67-89-ab]
IP=172.168.1.24
HostName=John Walker

#Entries without IP and HostName will not receive an IP to stop unauthorized computers.
[04-23-44-67-19-ac]

I added all known unauthorized MAC's. Now it's over 200 unauthorized MAC's on this list.

With OPENDHCP the logs shows the Mac to IP to User Name. (this is very helpful)
Authentication is done on the A.P.'s (EAP300 Engenius) with the same key for staff and students. (at one time it was separate keys but within one week the teachers would give the password to the students so I gave up. No support from Admin)

This worked fine until the students found out all the have to do is hard code the IP into their unauthorized computer or phone and now they get on the network. So I started blocking unwanted MAC addresses on each A.P. Then the students started spoofing the Mac addresses. I have a limit of 32 Mac's that I can block or allow on the A.P. (I've reach well over the limit of 32) I can't use the "allow Mac's" on the A.P. because I have over 32 that need to access each A.P. at any given time.

So now I'm seeking advice! Will something like FreeRADIUS work for Authenticating the Wi-Fi users or will I need to install something on the client side also? (in that I can't do.) Does anyone have anything they can suggest for me to do?

 

[Ralston18]

Rick,

It is difficult to respond (especially from afar) to an obviously complex and undisciplined situation that is certainly not of your making. It does appear that you have taken some pretty good steps towards a more secure and manageable system.

Without admin support from the highest level you will always be fighting unauthorized access issues and abuse by the user community.

That said: are you able to invoke any QoS settings: e.g., give the staff (admin and teachers) 60% of the bandwidth, Students 30%, cell phones 10%. The percentages may, of course, be re-allocated closer to real usage or administratively established limits.

Rather than trying to exclude unauthorized devices can your router be set up to white list authorized devices? Staff might be permitted two devices, students one. Again you will need admin support for whatever the allocation plan will be. Some sort of application form for each device that collects relevant information, provides rules of the road, and states the penalties for abuse.

Can you monitor what websites are frequently visited and block the academically unneccessary sites via your router? I will also look at the TL-R470Tt documentation just to get a sense of the capabilities and configuration management available with that device. Probably 80% of your bandwidth is consumed by 20% of the sites used. Abusers will find or establish ways around any blocked sites but at least there will be some inconvenience involved.

Do you have a budget? Do not need to know the $ amount - more interested in if the administration is willing to spend money to secure the overall school network. I have the feeling that privacy and security issues probably do not mean much to the admin side of things.

I am not familiar with FreeRADIUS but will take a look at the documentation.

Please fill in a few more details regarding constraints and the overall network configuration. Do not need IP's, network names, etc..

Maybe we can come up with some more ideas that will help.

Take care,

Ralston18

 

[bill001g]

I really have no clue how you managed to get that ip address scheem to work. Generally you must use vlans when you have different subnets. You can technically overlap them which is what I suspect you did but it make dhcp server almost impossible.

I would use 172.16.0.1 as your gateway with a mask of 255.255.240.0. This will give you 4k worth of addresses. ie 172.16.0.1-172.16.15.254 so you should never run out no matter how many devices.

If your equipment supports vlans you could actually assign different SSID to different groups and you would use different ip. I would go one step at at time though.

Free radius is the easy solution to your problem. Every person would have a individual id not tied to any particular device. You will still get lists of mac and ip they log into so you will quickly discover is someone is sharing their password.

You could just warn people that if bad things happen they will be first in line to take the blame so if they share a password they are responsible for all traffic.

radius works on almost all devices.....it actually only runs on the AP. The end stations use WPA2-enterprise mode. Now if you really want to only allow authorized devices even if someone would have a password you can run have radius use certificates on the clients. This tends to prevent any one but the most hard code from getting unauthorized devices on the network because it is not simple to extract a certificate from a end machine. Maybe you could put them on the instructor machines because it tends to be tricky to get setup the first time.

 

[Rickinajijic]

Rick,

It is difficult to respond (especially from afar) to an obviously complex and undisciplined situation that is certainly not of your making. It does appear that you have taken some pretty good steps towards a more secure and manageable system.

Without admin support from the highest level you will always be fighting unauthorized access issues and abuse by the user community.

That said: are you able to invoke any QoS settings: e.g., give the staff (admin and teachers) 60% of the bandwidth, Students 30%, cell phones 10%. The percentages may, of course, be re-allocated closer to real usage or administratively established limits.

Rather than trying to exclude unauthorized devices can your router be set up to white list authorized devices? Staff might be permitted two devices, students one. Again you will need admin support for whatever the allocation plan will be. Some sort of application form for each device that collects relevant information, provides rules of the road, and states the penalties for abuse.

Can you monitor what websites are frequently visited and block the academically unneccessary sites via your router? I will also look at the TL-R470Tt documentation just to get a sense of the capabilities and configuration management available with that device. Probably 80% of your bandwidth is consumed by 20% of the sites used. Abusers will find or establish ways around any blocked sites but at least there will be some inconvenience involved.

Do you have a budget? Do not need to know the $ amount - more interested in if the administration is willing to spend money to secure the overall school network. I have the feeling that privacy and security issues probably do not mean much to the admin side of things.

I am not familiar with FreeRADIUS but will take a look at the documentation.

Please fill in a few more details regarding constraints and the overall network configuration. Do not need IP's, network names, etc..

Maybe we can come up with some more ideas that will help.

Take care,

Ralston18

Ralston, First I would like to thank you for taking the time in assisting me with my network. I will answer your questions in order they were presented.

Admin support: The two directors are so busy with making the school run and dealing with problems they have given me 100% charge over the network. Up to the point of making any and all decisions myself without any of their authorization.

QoS, we have 12 A.P.’s of the 12 there are two different hardware versions (from the same maker) and with three different firmware versions. (I’ve looked into updating the firmware but with the lack of documentation from the maker and with research I’ve read many people tried to update the FW (properly) and bricked the A.P.) so I’m a little hesitant because of lack of funds if I brick an A.P.

Of the 12 A.P. we can set a QOS on 5 of the devices, the other 7 devices do not have provisions to set more than one network. I.e. Admin net/Student net. Only can have one.

The closest thing to a router (or layer 3 device) that we have is the "TP Link TL-R470T+" Load-balancing Firewall. It has limited functionality for rules (limit of approx. 32 rules). I can set up “Groups) By MAC addresses but even that has a limit of approx. 32 entries. I can limit bandwidth with this device but it also is limited to the 32 entry problem.
Other than the TP-Link we have the two TelMex DSL modems on the outside of the Load-Balancer. These unfortunately are of “Home network” quality and do not even have features of a small business modem. They do have QOS rules with a limit of approx. 50 entries (user Mac addresses).

Ii I'm reading in correctly when you say a “white list” this would be on a router or a layer 3 switch assigned at the port?
“Again you will need admin support” I have spoken with the Administration and informed them of the need to implement better policies. (when I came they had none). It did not become relevant to either of them until it was their IP address that was taken and they could not get on the network. So as of three days ago they are writing more stringent policies and implementing disciplinary actions for the offending students.

Can you monitor what websites are frequently visited…… Most abused websites: Facebook, Spotify, Steam (gaming site), internet radio, Skype, Bit Torrents used for movie and game downloads….. ect.

I have set rules on the firewall for only needed protocols.
DNS Port 53, HTTP Port 80, HTTPS Port 442, POP3, SNTP (first allowed) then at the bottom block all other ports 1- 65535. (not allowed)
But even so most of the offending websites then resort to using port 80 and 442 by default. I tried adding block URL by site without success. The sites use to many domain addresses and the firewall does not block by (example) www.facebook.com You can type it in but it does nothing. A known problem with a TP-Link.

At this point I was thinking a proxy server but even that can be circumvented, we have 3 to 4 very knowledgeable students.
My budget consists of asking a local philamprothist for money, she is the one that built this school and her daughter is one of the Directors of the school. So far she has donated a lot of money, I ask for what I need but I try to keep it as slim as possible (for example:. I was able to receive $3,000 to build a computer for the Audio/Video class.) in that close to $1,000 was shipping and import fees. There is only “VERY LOW” quality computer/networking parts here in Mexico so I use Amazon.com.
I can ask for and receive pretty easily between $400 to $600.

Constraints: As far as decisions, I have total and final say on anything I do to the network. Computers and Networking is my passion and they know that anything I say is “needed to be done” will be for the betterment of the network.

As far as hardware constraints:
1. We do not have any sort of layer 3 switching device on the network and that use ACL’s or a white list.
2. Little to no access to locally bought devices.
3. No “real” firewall (TP-Link is fine for home use) but a better solution would be a real firewall. (Many years ago when I worked at a stockbrokerage I used Checkpoint Firewall One)

Network configuration:
End users enter the network via A.P.’s in the class room. The A.P. uses WPA-PSK mixed (For Security Mode) with AES (encryption. ) We have “Guestnet” and “Schoolnet” on 5 A.P.’s and just “Schoolnet” on the rest.

Once they authenticate to the A.P. they are sent to OpenDHCP to check if the Mac is blocked. If not they are assigned via DHCP a Static IP to the Mac address and to the name of the student/staff member.

From that point most student traffic goes to the internet (Khan Academy, YouTube) for class work. The traffic leaves the end user computer to the A.P. then to the TP-Link loadbalencer/firewall from the firewall then to the two TelMex DSL modems and off to the internet.

The staff/Admin traffic enters the network either by RJ-45 or Wi-Fi. “If by Wi-Fi” they first authenticate to the A.P. then hit the DHCP server to check Mac for authorization then receive an IP address.

If by RJ-45 they hit the DHCP for Mac and IP, this traffic either then goes to the server to do Admin work (excel, Word and so on) OR….
Go to the TP-Link Loadbalencer/Firewall then to the two TelMex DSL modems and off to the internet. internet (to use Fedena school software)

 

[Rickinajijic]

I really have no clue how you managed to get that ip address scheem to work. Generally you must use vlans when you have different subnets. You can technically overlap them which is what I suspect you did but it make dhcp server almost impossible.

I would use 172.16.0.1 as your gateway with a mask of 255.255.240.0. This will give you 4k worth of addresses. ie 172.16.0.1-172.16.15.254 so you should never run out no matter how many devices.

If your equipment supports vlans you could actually assign different SSID to different groups and you would use different ip. I would go one step at at time though.

Free radius is the easy solution to your problem. Every person would have a individual id not tied to any particular device. You will still get lists of mac and ip they log into so you will quickly discover is someone is sharing their password.

You could just warn people that if bad things happen they will be first in line to take the blame so if they share a password they are responsible for all traffic.

radius works on almost all devices.....it actually only runs on the AP. The end stations use WPA2-enterprise mode. Now if you really want to only allow authorized devices even if someone would have a password you can run have radius use certificates on the clients. This tends to prevent any one but the most hard code from getting unauthorized devices on the network because it is not simple to extract a certificate from a end machine. Maybe you could put them on the instructor machines because it tends to be tricky to get setup the first time.

Bill, Thanks for the reply!
How the IP and DHCP is arranged is using OpenDHCP with the config like this

Schooldhcp
#school Network
172.168.1.252

[LOGGING]
#LogLevel=None
LogLevel=Normal
#LogLevel=All
#LogLevel=Debug

[RANGE_SET]
DHCPRange=172.168.1.1-172.168.1.250
DHCPRange=172.168.2.1-172.168.2.250
DHCPRange=172.168.3.1-172.168.3.250

SubnetMask=255.255.0.0

DomainServer=8.8.8.8, 8.8.4.4
Router=172.168.1.254
#specify 0 for infinity.AddressTime
AddressTime=0

Only IP's of the 172.168.1.X subnet are assigned to:

Staff/Admin Mac's (i've collected all staff, admin, student Mac Addresses.

All network devices and servers are on the .1.X network as is the F.W., DHCP and servers. (server access)

The IP's of the 172.168.2.X net are assigend to students only. (no server access)

The IP's of the 172.168.3.x net are assigend to staff/admin phones only. (no server access)

Only people on the .1.X network need to use the server. There is no reason for the .2.x or the .3.x network to communicate or use the server.

We have no layer 3 switches or even a router on the network. It's a flat network at this point. I know it's not optimal but it works until i can improve it.

As far as this IP scheme being hard on the DHCP server it's not a problem.


Bill, so are you saying that with Free Radius i would be able to set up and use without installing anything on the student, staff computers? I realize if so it would not be using certificates. Anything installed on the student computer would be quickly removed my the student.

 

[bill001g]

WPA-enterprise means radius...well mostly technically it can be something else. Almost all devices support WPA enterprise.

Your DHCP method is very non standard. It is extremely dependent on static assignment of mac/ip which is a pain. If you would have say three pools of ip and a pc would make a request it would be random which pool they would end up in.

Unless you have a firewall there is nothing stops users from accessing all ip in the same subnet. You will have no isolation between clients.

 

[Ralston18]

Rick,

Thank you and it sounds as if you have made a bit of progress already. I also feel much more comfortable about your knowledge level and experience. Nice to know that "the other side" can be an active partcipant and is being very pro-active. That said you must also feel free to let me know if I go astray somewhere. Been known to happen....

Two preliminary comments:

1) Priorities: What do you deem as being most important? Importance being defined as you see it - not me. Politically it makes sense to first get the administrators "world" in good order just to demonstrate immediate benefits. Or maybe overall network performance. Or security. Best ROI. Your call there.

2) Tactical: I noted that billg001 offered some specific suggestions. And I was very glad to see that as he is one of contributors that I follow/read in this forum. (Thank you billg001). I would certainly defer to his counsel and suggestions. No offense taken here.

I will need to read more about Free Radius and your TL-470T. Just to sort of keep up with you guys.

Will continue to follow this thread, read, and post as warranted.

 

[Rickinajijic]

WPA-enterprise means radius...well mostly technically it can be something else. Almost all devices support WPA enterprise.

Your DHCP method is very non standard. It is extremely dependent on static assignment of mac/ip which is a pain. If you would have say three pools of ip and a pc would make a request it would be random which pool they would end up in.

Unless you have a firewall there is nothing stops users from accessing all ip in the same subnet. You will have no isolation between clients.

Bill, Boy do I know it is not standard and not in "best practices" I need to work with what I have. :-(

How I have OpenDHCP set up is this way.
I first collected and documented all Mac addresses from authorized computers. One computer per staff/student and one phone per staff/Admin member.

Each person's Mac is assigned an IP address to the Mac then given the host Name of the person. The config looks like this:

[00:02:3A:CD:2C😀A]
IP=172.168.1.11
HostName=Staff Jose Gonzalez

If there is an entry like this:

[10:30:47:ea:10:5d]
That Mac is refused an IP address by default.

I check the logs in the DHCP server in the morning for new unauthorized Mac's. They are easy to spot because the host name will be something like User-PC or HP-Computer. It will not show the standard student name or have Staff in the name.

We do it this way (because of lack of equipment) and also when I check the logs (or look at the A.P. for traffic) to see how much data a computer is downloading (like a game) I can then also see the students name, block that IP and send my assistant to speak with the student. If it happens again they get wrote up.

I am aware that all they need to do is spoof a Mac address and they get on the network with an open IP. But this only happens one time and that Mac is blocked. The problem is when they spoof over and over again as on student does. But this works for us 99.9% of the time.

I do understand there is no isolation between users but without a router for VLAN's and little to no budget this is what I need to do at this point. But it's also why I'm seeking advice.

 

[Rickinajijic]

Rick,

Thank you and it sounds as if you have made a bit of progress already. I also feel much more comfortable about your knowledge level and experience. Nice to know that "the other side" can be an active partcipant and is being very pro-active. That said you must also feel free to let me know if I go astray somewhere. Been known to happen....

Two preliminary comments:

1) Priorities: What do you deem as being most important? Importance being defined as you see it - not me. Politically it makes sense to first get the administrators "world" in good order just to demonstrate immediate benefits. Or maybe overall network performance. Or security. Best ROI. Your call there.

2) Tactical: I noted that billg001 offered some specific suggestions. And I was very glad to see that as he is one of contributors that I follow/read in this forum. (Thank you billg001). I would certainly defer to his counsel and suggestions. No offense taken here.

I will need to read more about Free Radius and your TL-470T. Just to sort of keep up with you guys.

Will continue to follow this thread, read, and post as warranted.

Ralston, I’m not even close to knowing what I’d like to know but I have a little experience in computers and networking.

I have my MCP, CST, A+ and my PC/LAN Certification, but I’ve used, built, repaired and wrote programs for 27 years.

I’ve worked for two different organizations as a network engineer. The most recent network was for a University.

This network had 65,000 nodes, 16,000 pagers and 16,000 phones (we had our own phone switch )
The network at that time used static IP’s it took about 1 ½ years but I implemented DHCP.

We had three networks running in parallel one for “life Net” (it was the hospital part of the University I worked for) one for Staff and the other was Guestnet.

We had 168 wiring closets and we had 168 VLAN’s on the network. It was an Enterprise network with four Cisco Catalyst 6509 core routers, some 750 edge switches (Cisco 3500, 3508, 2900 etc.) 350 APC UPS’s another 350 ATS’s (Automatic transfer switch for power) with triple redundant power. Main power, UPS power and emergency backup generator power.

They did not monitor the network (one of the reasons they hired me for) so I implemented HP OpenView. In short, I had to modify the software (to use our needed Mib’s) to monitor the load on the cores and edge switches for loadbalencing. (We used OSPF and cost route) if it was up or down, temps of the IDF’s ELC (volts watts) in to the UPS’s Elc out and much, much more.

It took over a year to modify and implement HP OpenView but when I was done the Network Eng. would get a page with the IDF, switch number IP address of the down switch the IP of the switch above and below and to what core switch it was on. If using a smart phone you would also receive a map to get to the IDF (the hospital was some ¼ mile long and up to 12 stories. So finding what IDF on what floor was hard before this.
At the University my budget was several hundred thousand dollars a year. (Unlike the place I work now).

My priorities are to keep unauthorized computer devices off the network as much as possible. The students bring in a second laptop and play games all day or download games and videos.

Try to limit access to the A.P.’s to only authorized computer devices by Mac address. I do understand it is a lot of work this way. IP to Mac to User but this is what I get paid $3.50 an hour for (at the University I received $78,000.00 a year) . (LOL! Is true!$3.50 an hour, in Mexico this is good money) I told you I love computers and Networking. I’m retired Army and have a pension so I don’t need the money)

I don’t think there ever will be real consequences from the Admins to the offending students. Just won’t happen.
With that said it does not stop me from doing the best I can do. …. For me…. I want to offer the best possible network I can with what I have and what I can get. (Sort of a pride thing).

The best speed as secure as I can get it with as few students screwing around with games and watching movies.
I know there will always be a student able to circumvent what I do but I want to keep it to a minimum.

I’m looking more into Free Radius now that I hear it is a possibility.

 

[Ralston18]

Rick,

Appreciate the added insight both personal and professional.

My sense is that you have a fair amount of flexibility (budget aside) within your current environment.

I did scan through the documentation for your TL-470T router and for Free Radius. Have a better sense of what the router can do and how it can be configured to some extent.

As I understand the Free Radius documentation it requires Linux and will not run in a Windows environment. But Free Radius is free and apparently run in some rather sizable environments. Maybe you could set it up on a dedicated computer or perhaps in a VM on an existing computer. The latter may be impractical for a number of reasons but you will be the best judge of that.

Overall probably well within your skill set and experience. The Linux community is well known for being supportive in many forums so there would be plenty of help there if needed.

Any chance that you could get one of your former employers to donate some old equipment? Reuse, re-purpose, recycle..... (I know that there are restrictions on sending certain technologies to other countries. Could be opening another can of worms there. Had to ask anyway.)

Once you have had a chance to look into Free Radius then (provided it remains viable) you could look at a redesign of your network in accordance with your needs and objectives plus some resolution of the necessary IP addressing and subnetworking (Ala Bill001's postings).

Plan it the way you want it to be and then start fitting the pieces together. Sort of a neat project overall.

As a side thought what about getting a few of the brighter, more trustworthy students involved via a computer club? The old "if you can't beat them join them" tactic but in reverse. Just a bit of redirection. No need to give them full keys to the kingdom but some "allies/assistants" may be beneficial. Good learning experience for all.

Not sure what else to add at this point so will continue to track and post along with anyone else willing to offer ideas, suggestions, or direct solutions.

Take care,

Ralston18

 

[Rickinajijic]

Rick,

Appreciate the added insight both personal and professional.

My sense is that you have a fair amount of flexibility (budget aside) within your current environment.

I did scan through the documentation for your TL-470T router and for Free Radius. Have a better sense of what the router can do and how it can be configured to some extent.

As I understand the Free Radius documentation it requires Linux and will not run in a Windows environment. But Free Radius is free and apparently run in some rather sizable environments. Maybe you could set it up on a dedicated computer or perhaps in a VM on an existing computer. The latter may be impractical for a number of reasons but you will be the best judge of that.

Overall probably well within your skill set and experience. The Linux community is well known for being supportive in many forums so there would be plenty of help there if needed.

Any chance that you could get one of your former employers to donate some old equipment? Reuse, re-purpose, recycle..... (I know that there are restrictions on sending certain technologies to other countries. Could be opening another can of worms there. Had to ask anyway.)

Once you have had a chance to look into Free Radius then (provided it remains viable) you could look at a redesign of your network in accordance with your needs and objectives plus some resolution of the necessary IP addressing and subnetworking (Ala Bill001's postings).

Plan it the way you want it to be and then start fitting the pieces together. Sort of a neat project overall.

As a side thought what about getting a few of the brighter, more trustworthy students involved via a computer club? The old "if you can't beat them join them" tactic but in reverse. Just a bit of redirection. No need to give them full keys to the kingdom but some "allies/assistants" may be beneficial. Good learning experience for all.

Not sure what else to add at this point so will continue to track and post along with anyone else willing to offer ideas, suggestions, or direct solutions.

Take care,

Ralston18

Sorry for the delay in response, we had a power supply go out on one of the servers and I needed to move the data to another computer temporarily (no money for replacement power supply right now.)

I have found a version of FreeRadius that runs on Windows Version 1.1.7-r0.0.2 Downloaded from here, http://freeradius.net/Downloads.html however, I’m not sure if it is a newer version or an older one.
I’m not certain I want to use the Windows version of FreeRadius, once we get the power supply for the server I can then use the temporary replacement computer for the Radius server running Linux.

In doing research my first thought was to use FreeRadius to do authentication by Mac addresses (for the time being). I have found conflicting information on this. Here I find an outline on how to do it http://wiki.freeradius.org/guide/Mac-Auth#Plain-Mac-Auth but in the FreeRadius mail list I find to the contrary, perhaps that was a really old post. I no longer can find it.

On another note: I’m contemplating on buying a layer 3 switch myself and donate it to the school. This depends on what I can have sent to Mexico and the cost.

I have found an HP layer 3 switch that can be sent to Mexico sold on Amazon if you do a search for HP 24-Port L3 Managed Switch (JG538A#ABA) here is a link to the product overview: http://www8.hp.com/h20195/v2/GetDocument.aspx?docname=c03824531 It can be shipped here for a total of $158.68

Even though this is not the optimum layer 3 switch I think it would/could address the VLAN concerns that have been brought up.

What do you think?

We have one month left of school before it's out for the summer. I may think about a computer club for next session.

 

[Ralston18]

Glad to see that some options are showing up.

The HP Switch appears to be quite viable and configurable. 500+ page user manual so, for me at least, there would be a lot of pre-planning involved.

Probably best, on my part, to let bill001g Et. al. offer guidence if there are any configuration questions or problems with the switch.

Also, as you are probably aware, you can take some older routers and install DD-WRT. Works on quite a few brand name routers and the DD-WRT site lists those routers. DD-WRT has VLAN capabilities but may not be quite enough capability for your needs. DD-WRT has a very large and very good support group. The initial installation must be carefully laid out and executed to avoid bricking the target router. If you can get hold of some older qualifying routers and get them at low cost or no cost then DD-WRT may something to consider. Great student project too....

That is it for now. Will keep tracking this posting and mull over anything else that comes up. Take care.

 

[Rickinajijic]

We received the HP 1910G (JG538A ABA) end of last week. Now I am figuring out how I will separate the network into VLAN's. Floors 1,2,3 (AP's) with VLAN's for Admin, Students, Guests. Now one limiting factor might be the OpenDHCP software I use for the DHCP server. I need to investigate this more.