0

I have an HP procurve switching environment in which users are often assigned static IP's. One user changed their IP to 172.17.1.1 which is the core switch VLAN 10 interface. Since all the users in the environment have dynamic ARP tables, the ARP entries were affected and there were spurious outages for as long as that user was connected.

In order to prevent this from happening again, there are 3 approaches we can take:

  • Publish a GPO to prevent users from modifying their own settings, but this won't work for non-domain devices
  • Change existing critical devices on that subnet to use static ARP tables, but doesn't really "solve" the problem, just mitigates it. It will still affect new devices and each device will need to have a static ARP entry added when installed, and changed if/when the switch is replaced.
  • Perhaps the best solution, use the ip source-binding command on the switching infrastructure to ensure that anyone who changes their IP to the gateway(s) on the core switch VLAN interface will not have network access.

My questions are:

  1. Am I correct in my belief that ip source-binding is the best bet here? It will only be used on switches that have an IP in the respective VLAN since otherwise it would have no ARP table for that VLAN.
  2. If so, how is it possible to do ip source-binding that binds the VLAN interface of the switch itself? I want to ensure the switch drops all incoming ARP responses claiming its own IP address of 172.17.1.1

Additional Info: the core switch (where we want to restrict the ARP traffic) is a 5412R Zl2 chassis (model J9851A) running firmware version KB.15.17.0008

Thank you

  • 1
    Please add your Procurve switch model to your question - they differ quite a bit over generations. – Zac67 Jul 18 at 18:55
  • @Zac67 added, thank you. – Goodies Jul 18 at 19:01
  • 1
    Rather than assigning specific IP addresses to be statically configured on the devices, you can use DHCP reservations so that the devices still use DHCP, but get the same address every time. Then you can follow the answer from @Zac67 and use DHCP snooping and dynamic ARP inspection to prevent users from working if they set a static IP address on the host. – Ron Maupin Jul 18 at 20:28
3

The 5400 series supports DHCP snooping with ARP protection which is your best option. Those force a client to use the IP address it is assigned by the authorized DHCP server(s). Any other traffic is dropped (with an optional SNMP trap).

Using reservations on your DHCP server allows you to assign and centrally manage specific IP addresses for each client - that is far superior to managing static IPs manually anyway.

Then you force the clients to use DHCP:

    dhcp-snooping authorized server [dhcp-server]
    dhcp-snooping trust [server-port]
    dhcp-snooping vlan [vlid]
    dhcp-snooping verify
    arp-protection vlan [vlid]
  • [dhcp-server] is your DHCP server's IP address
  • [server-port] is the port that DHCP server is located on
  • [vlid] is the VLAN ID from the client network

Caution: With that config, only clients with a valid DHCP lease can communicate. You need to define ports where clients with arbitrary IP addresses are allowed:

arp-protection trust [port list]

Alternatively to DHCP & snooping you could use a static database to feed ARP protection (ip source-binding) - that might be hard to maintain (in addition to the actual client configs) so I'd use DHCP in any case.

Of course, there are other ways to accomplish what you want - removing admin priviledges or using GPO to enforce a configuration are off-topic here however.

  • Fine, except the OP is using static IPs – Ron Trunk Jul 18 at 19:56
  • 1
    @RonTrunk Yes - and I'm strongly suggesting to go DHCP. – Zac67 Jul 18 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.