Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

What would be the correct way to force a client on an access port to use a dynamically assigned IP address ?

In other words, using the Cisco access layer switch, I would like to prevent the client's ability to set up a static IP address + gateway and bypass the DHCP completely.

Is this possible using features such as DHCP Snooping ?

share|improve this question
    
No, this would only be for wired clients connected to 2960S types of switches. –  Jeremy G. Jun 13 at 9:18

2 Answers 2

up vote 4 down vote accepted

What would be the correct way to force a client on an access port to use a dynamically assigned IP address ?

You can't "impose" an IP configuration mode to an host from the switch (or any other device) AFIK. You can prevent the communication between the host if he don't have an IP from the DHCP.

In other words, using the Cisco access layer switch, I would like to prevent the client's ability to set up a static IP address + gateway and bypass the DHCP completely. Is this possible using features such as DHCP Snooping ?

What you need is the feature IP Source Guard

this feature is enabled on a DHCP snooping untrusted Layer 2 port. Initially, all IP traffic on the port is blocked except for DHCP packets that are captured by the DHCP snooping process. When a client receives a valid IP address from the DHCP server, or when a static IP source binding is configured by the user, a per-port and VLAN Access Control List (PVACL) is installed on the port. This process restricts the client IP traffic to those source IP addresses configured in the binding; any IP traffic with a source IP address other than that in the IP source binding is filtered out.

share|improve this answer

I don't think that this is possible. At least not using a switch.

Only way I see to solve the problem: Only allow device on your network that are under your control. So no admin privileges for users, no bring your own devices, ...

Using something like 802.1x might help to enforce the policy.

share|improve this answer
    
Source guard is the correct answer; speculation fail –  user5025 Jun 13 at 12:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.