DHCP Deny Filter

Question

I had a question about the DHCP deny filter.  I've added a few users to the deny filter in one of our scopes in DHCP.  I see some users still in the scope with the filter profile of deny, and I see a few under the Filters > Deny.  Can
I reasonably assume bot are working properly?  And with this filter, these MAC addresses can no longer authenticate to the network?
The reason I'm asking is I'm debating whether or not to block the MAC addresses on the Aironet (these are all wifi users) or to just leave the deny policy on the DHCP.

Answer 1

Hi,
Im sorry to hear that. You do add them to the filter by going to the leased ip addresses an right-click add to filter, right? you could try to run the BPA associated with DHCP an see if there is something we've missed. Under normal conditions it works flawless
but it might depend on certain aspects that we currently don't know but we will find them out. 
You are positive there is no other DHCP server/router/nas/etc leasing addresses in your network. The filter option in new to 2008 R2 and was not available in earlier versions, it's equivallent for 2003/2008 was something called
Callout DLL. You could try to run a packet sniffer like \wireeshark or Microsoft Network monitor to see what happens. Make sure that you are not filtering any reserved ip addresses.http://technet.microsoft.com/en-us/library/ee941155(WS.10).aspx.
You also might want to try the reverse if it;s not to much effort, create an Allow list and then the Deny list should be populated. 
http://technet.microsoft.com/en-us/library/ee956897(WS.10).aspx
Also there is a Step by Step guide to demonstrating DHCP filtering in a lab/test enviroment. I reccomend using virtual machines : http://technet.microsoft.com/en-us/library/ee405265(WS.10).aspx
If you tried all of the above post an ipconfig /all from a DHCP Client that is not blocked, although his mac address is filtered. 
You could bypass this MAC filter by using MAC spoofing or setting a different MAC address. Although I doubt this is the case have that in mind also.
Thanks.
MCTS - Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.