User access control to the Network

[olly ahmed]

Hi All,

I am asking for help to know about controlling my users from accessing the network. The scenario is given below:

1. I want to configure a L3-switch as DHCP server with DHCP snooping enabled

2. I also want to enable ARP inspection

3. Now I want users will get IP from DHCP-server router but that user won't be able to communicate using network. I am planning to deny all IP packet except those I permit by ARP Access-list. 

Now my question is, whether it is possible or not to do this by ARP access-list ?

If your answer is no then please suggest me the way to control my users from accessing the network until I permit them manually while DHCP server, DHCP snooping, ARP inspection all are in action. Would also appreciate if you please share a sample configuration.

[Martin L]

you wrote users will get IP from DHCP-server router and L3-switch as DHCP server with DHCP snooping enabled, which is it?
more likely PCs will get IPs from DHCP Server like Microsoft and not from router, but u can set up a router as DHCP server no problem.
DHCP snooping should be enabled on access layer switch, not on L3, same goes with ARP inspection feature.
do we have L2 access sw?

[Martin L]

DHCP snooping and ARP inspection work on L2 switch with port that are trusted - like trunks.