PIX 515e MAC to IP

[muhammadaliraja]

Hi,

I have the following network.

2 WAN links termination on my PIX 515e and all internal users connected to third interface.

Problem I am facing is that I have assign manual IP to users with some have full access to Internet while others have limited.

The users are changing their IP address while others are offline and I want to restrict them.

The only way I can think off is by binding IP to MAC as e.g ( Active wall software). But can it be done on PIX 515e and if so how ???

Sent from Cisco Technical Support iPad App

[Harish Balakrishnan]

Hello Ali,

I am not sure the OS version you running on your PIX515E, but this can be done with the following command

arp interface_name ip_address mac_address

example :

arp inside 1.1.1.1 abcd.0001.1111

Hope this helps

Harish

Please rate all helpful posts!

[muhammadaliraja]

Thanks for the reply.

I will try this tomorrow.

Sent from Cisco Technical Support iPad App

[cadet alain]

Hi,

you have to to enable arp inspection before: arp-inspection inside enable

But you'll have to do this for all users so it's not very scalable.Why not simply put a GPO that refrains users from changing their TCP/IP setting from DHCP to static ?

Regards.

Alain

Don't forget to rate helpful posts.

[muhammadaliraja]

Dear Alain

I am in routed mode of PIX not in Transparent mode so  ARP-INSPECTION will not work.

any other suggestion !!

[cadet alain]

Hi,

What type of switches have you got inside ?

Regards.

Alain

Don't forget to rate helpful posts.

[muhammadaliraja]

Dear Mr. Alain

I got 8 WIFI linksys E4200 bridge mode terminating on 3Com 3250 switch.

But the 3250 doesnot support IP to MAC binding. only port security which is useless as I hav users connecting through Wifi rather than individually connected to physical ports of the switches.

[cadet alain]

Hi,

ok so are the hosts Windows hosts or linux hosts?

Regards.

Alain

Don't forget to rate helpful posts.

[muhammadaliraja]

Hi,

Windows Hosts and no AD.

[cadet alain]

Hi,

ok so you could add a local GPO policy on each hosts.

Regards.

Alain

Don't forget to rate helpful posts.

[muhammadaliraja]

I could but I want to do this via PIX if possible.

Sent from Cisco Technical Support iPad App

[muhammadaliraja]

Dear Harish,

As per your tip, it adds another ARP of same MAC and now their are two ARP of same MAC.

The concept was to stop dynamic updation of ARP and allow only static or defined ARP table or IP to MAC binding.

Issue remains unsloved.