New Device Alert

[nmiller0113]

I recently moved from Untangle to opnsense.  Everything is running great but I cannot seem to figure out a good way to get alerts when new devices appear on my internal network(s).  I like to be aware of new connections so I know if someone new jumped on my wireless or connected to my LAN.  It's just for the sake of knowing and making sure it's legit and not some rogue device.  Untangle had an easy way of doing this, and I understand that opnsense is a completely different platform and I'm not necessarily looking for an as easy solution...just *a* solution...either using what's part of the platform by default or through the use of an additional features.  Either works for me, I just want to be able to get an email every time a device, not previously known or on the network, connects.  Thanks!

[MasterXBKC]

I could make this work for you, i have built a number of tool for pfsense and opnsense. 

[nmiller0113]

Awesome!  How hard would it be to create?

[Micky]

You could use a raspberry with nmap-skript, too. If unknown Clients were found you can send a pushover-message or mail ...

Gr. Micky

[beren]

I know this is old, but has anyone come up with an easy solution? It would be really nice if it could use the dhcp static lease file as filter as well, so known devices don't get logged.

[Mark1]

Hi,

is it to trivial or is there simply no solution to receive an email on new devices?

I would really appreciate a short feedback whether it is possible or not.

Thanks,

Mark

[chemlud]

I don't know an easy way to make the DHCP server send an email for every new (!) lease. Would be interesting for other functions (IDS), too...

If you want to hand down IPs on your network manually (reserved for MAC) this can be done quite easily.

[mimugmail]

You can try to install arpwatch via ports

[Mark1]

Thank you.
Conclusion, with the standard opnsense release a new device alert is not possible.

Interesting fact as the first question from the GDPR guy was how we get notified on new devices.

[hbc]

What about new devices not using your gateway?

I would try switch port security and block unknown devices on access layer --> 802.1x.
New devices have to request a computer certificate in IT dept.

[mimugmail]

What about new devices not using your gateway?

I would try switch port security and block unknown devices on access layer --> 802.1x.
New devices have to request a computer certificate in IT dept.

Indeed a way better solution

[mimugmail]

There is now one :)

https://forum.opnsense.org/index.php?topic=20827.msg126436#msg126436