How to hand out DHCP Leases to Mitel Devices Only

[Mattmayn]

I know that I have seen the option before but I could not find it today. I have been requested by a "Security Specialist" to have my 3300s (MCD 4.0 SP2) on a customer's site only hand out leases to Mitel equipment. I thought this was a check box somewhere in the System IP Config area. Am I wrong?

[Chakara]

  I think that DHCP is DHCP and if a device is on the same broadcast domain (VLAN) then the Mitel will give out the address.  That seems like an odd request.....

-Chak

[Mitel100]

As you said this security expert is making sure that the 3300 only hands out IP addresses to Mitel phones, of course out of the box it will handle requests from all equipement request DHCP.

There is some programming on the 3300 you can do on the DHCP setting to only allow the 3300 to distribute IP addresses to mitel phones. It is as follows: (Copied from MOL)

'In order to prevent any other device except a Mitel IP Phone from getting an IP from the Mitel DHCP server, follow these steps

1. Give your IP Address Range the following name: ipphone.mitel.com
2. Enable the Client's class ID must match name option in the IP Range.

This causes the DHCP server to ignore all non-mitel IP Phone requests for an IP address. Please note that controller must be running 7.0 software or higher. As well if any new phones are added, then this option needs to be turned off until they upgrade their flash for the first time.'

[ralph]

I'm not sure on this so you'll have to experiment a bit.
But under DCHP Address Ranges there is this option: "Client's class ID must match name: "
Set it to True and then test.

Ralph

[Chakara]

  Very cool - now I have to read up more on DHCP to see how that works.  Sounds like a DHCP client may advertise what time of device it is in the DHCP request...

-Chak

[Mattmayn]

Thank, I'll let you guys know if it makes him happy or not.

I love it when people suddenly take an interest in phones and start making demands, I mean requests, about the config. Two years after the install!

[Mattmayn]

Only drawback is the fact that this has to be disabled every time you want to add a new phone.

[johnkeri]

This is a very old thread but it is still valid, and would like to make it clear that the previous post is incorrect.
You do not have to change this option when adding new phones.
The option Client Class ID must match is valid since all Mitel IP phones use the same Class ID string 'ipphone.mitel.com'.

The real drawback is connecting to the system with your computer on that VLAN, since that is not a Mitel device it will not get an IP address.
Suggest implementing this feature for security and performance if you have wireless devices on the voice VLAN.
- by adding static reservations to your wireless devices in combination with this option you can lock down your DHCP server

[VinceWhirlwind]

...and if somebody wants their laptop to get an IP address from the "locked down" DHCP scope, all they have to do is go to a command-prompt and tell it:
ipconfig /setclassid ipphone.mitel.com
 
Whoever the "security specialist" is, what they are doing here has not much to do with security and a lot to do with generating unnecessary work.

[petr.necas]

That security expert would also suggest to update the SW to the latest release 7.2 SP1 PR1. Am I right?

[johnkeri]

Not to be blunt, but argumentative.

Consider the scenario of wireless access points handling Spectralink phones that do not support security settings in the AP.
- any iPhone user walking by the building would get an IP address if there phone is allowed to access 'unknown networks'
- now that they have an IP address they know that there is a network and they can try to access it
- another problem is that you just ran out of IP addresses of your scope and none of the 'new' Spectralink phones want to work
The suggested configuration can prevent these problems.

[VinceWhirlwind]

...except you control who joins your wireless network through your wireless network security, surely, not through an easily-bypassed DHCP restriction.
Surely you wouldn't deploy a WiFi network that has no WiFi security?

[RogerV]

Is it going to be a single cable deployment or dual ?

I have some templates for dhcp server that I use but I dnt use the Mitel for dhcp I use an adtran router I can share if you like


Sent from my iPhone using Tapatalk