4 ms·
> IMHO the correct way to do this (assuming dynamic address assignment is desired), is via DHCP reservation And how many end-user/dynamic hosts did you ever ma
by justsomehnguy 3y ago
> IMHO the correct way to do this (assuming dynamic address assignment is desired), is via DHCP reservation
And how many end-user/dynamic hosts did you ever manage?
And more importantly, why a l33t hax0r, who is already in the internal network, as he can send DHCP requests, can't impersonate a MAC address?
- anonymousiam 3y agoI've managed quite a few, but typically you would want your "trusted" hosts on a separate VLAN or subnet from untrusted ones. It's probably fine to leave DHCP DNS Dynamic Updates turned on as long as it's not updating a DNS server with control over any trusted domains. As you say, a host could spoof a MAC and get a reserved assignment, but only if the real host with that MAC is down. Again, isolating the security perimeters is the answer.