How to force the use of a DHCP-issued IP on Cisco switch

Question

What would be the correct way to force a client on an access port to use a dynamically assigned IP address ?

In other words, using the Cisco access layer switch, I would like to prevent the client's ability to set up a static IP address + gateway and bypass the DHCP completely.

Is this possible using features such as DHCP Snooping ?

Answer 1

What would be the correct way to force a client on an access port to use a dynamically assigned IP address ?

You can't "impose" an IP configuration mode to an host from the switch (or any other device). You can prevent the communication between the host if he doesn't have an IP from the DHCP server.

In other words, using the Cisco access layer switch, I would like to prevent the client's ability to set up a static IP address + gateway and bypass the DHCP completely. Is this possible using features such as DHCP Snooping ?

What you need is the feature IP Source Guard, which uses the DHCP Snooping binding database to determine the legitimacy of source IP addresses.

This feature is enabled on a DHCP snooping untrusted Layer 2 port. Initially, all IP traffic on the port is blocked except for DHCP packets that are captured by the DHCP snooping process. When a client receives a valid IP address from the DHCP server, or when a static IP source binding is configured by the user, a per-port and VLAN Access Control List (PVACL) is installed on the port. This process restricts the client IP traffic to those source IP addresses configured in the binding; any IP traffic with a source IP address other than that in the IP source binding is filtered out.

^{"Chapter 14 - Switch Security" In Cisco Network Professional's Advanced Internetworking Guide (CCNP Series), 533 - 534.}

Answer 2

I don't think that this is possible. At least not using a switch.

Only way I see to solve the problem: Only allow device on your network that are under your control. So no admin privileges for users, no bring your own devices, ...

Using something like 802.1x might help to enforce the policy.

Answer 3

What you need is ip source guard combined with ip dhcp snooping. IP dhcp snooping protects against rouge dhcp servers by shutting down the port of the rouge dhcp server: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html

combine ip dhcp snooping with ip source guard, you can prevent someone from changing their ip from the DHCP assigned one to a manual one: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/ipsrcgrd.html