I have an HP procurve switching environment in which users are often assigned static IP's. One user changed their IP to
172.17.1.1 which is the core switch VLAN 10 interface. Since all the users in the environment have dynamic ARP tables, the ARP entries were affected and there were spurious outages for as long as that user was connected.
In order to prevent this from happening again, there are 3 approaches we can take:
- Publish a GPO to prevent users from modifying their own settings, but this won't work for non-domain devices
- Change existing critical devices on that subnet to use static ARP tables, but doesn't really "solve" the problem, just mitigates it. It will still affect new devices and each device will need to have a static ARP entry added when installed, and changed if/when the switch is replaced.
- Perhaps the best solution, use the
ip source-bindingcommand on the switching infrastructure to ensure that anyone who changes their IP to the gateway(s) on the core switch VLAN interface will not have network access.
My questions are:
- Am I correct in my belief that
ip source-bindingis the best bet here? It will only be used on switches that have an IP in the respective VLAN since otherwise it would have no ARP table for that VLAN.
- If so, how is it possible to do
ip source-bindingthat binds the VLAN interface of the switch itself? I want to ensure the switch drops all incoming ARP responses claiming its own IP address of 172.17.1.1
Additional Info: the core switch (where we want to restrict the ARP traffic) is a 5412R Zl2 chassis (model J9851A) running firmware version KB.15.17.0008