5

What would be the correct way to force a client on an access port to use a dynamically assigned IP address ?

In other words, using the Cisco access layer switch, I would like to prevent the client's ability to set up a static IP address + gateway and bypass the DHCP completely.

Is this possible using features such as DHCP Snooping ?

1
  • No, this would only be for wired clients connected to 2960S types of switches. – Jeremy G. Jun 13 '14 at 9:18
9

What would be the correct way to force a client on an access port to use a dynamically assigned IP address ?

You can't "impose" an IP configuration mode to an host from the switch (or any other device). You can prevent the communication between the host if he doesn't have an IP from the DHCP server.

In other words, using the Cisco access layer switch, I would like to prevent the client's ability to set up a static IP address + gateway and bypass the DHCP completely. Is this possible using features such as DHCP Snooping ?

What you need is the feature IP Source Guard, which uses the DHCP Snooping binding database to determine the legitimacy of source IP addresses.

This feature is enabled on a DHCP snooping untrusted Layer 2 port. Initially, all IP traffic on the port is blocked except for DHCP packets that are captured by the DHCP snooping process. When a client receives a valid IP address from the DHCP server, or when a static IP source binding is configured by the user, a per-port and VLAN Access Control List (PVACL) is installed on the port. This process restricts the client IP traffic to those source IP addresses configured in the binding; any IP traffic with a source IP address other than that in the IP source binding is filtered out.

"Chapter 14 - Switch Security" In Cisco Network Professional's Advanced Internetworking Guide (CCNP Series), 533 - 534.

0
1

I don't think that this is possible. At least not using a switch.

Only way I see to solve the problem: Only allow device on your network that are under your control. So no admin privileges for users, no bring your own devices, ...

Using something like 802.1x might help to enforce the policy.

1
  • Source guard is the correct answer; speculation fail – user5025 Jun 13 '14 at 12:41
-1

What you need is ip source guard combined with ip dhcp snooping. IP dhcp snooping protects against rouge dhcp servers by shutting down the port of the rouge dhcp server: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html

combine ip dhcp snooping with ip source guard, you can prevent someone from changing their ip from the DHCP assigned one to a manual one: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/ipsrcgrd.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.