What version of RIP are you running? If you are running RIPv2, you could setup route authentication. This should result in the routers not accepting routes from the Unix stations.
The easiset solution might be to use the distance command under the router rip configuration to set any route that is learned from the Unix stations to an administrative distance of 255. This will mark the route as unreachable and should result in the route no being installed into the routing table. This configuration would look like:
distance 255 172.16.32.1 0.0.0.0
In the example, the 172.16.32.1 IP address is that of the advertising device that I want to change the distance of the routes for. In your case, this would be the IP address of the Unix stations.
The other thing that you can do is setup an ACL that will filter RIP updates from coming into the routed interface of the Cat5000 for the VLAN that they are on. The config for this would look something like:
access-list 100 deny udp host 172.16.32.1 any eq rip
access-list 100 permit ip any any
interface vlan 100
ip access-group 100 in
The first line of the ACL from the example matches any RIP packet coming form a source IP address of 172.16.32.1. If you replace this with the IP address of the rogue Unix system, it should prevent any RIP packet from entering into your router and thus preventing the routes from entering your routing table. The second line of the ACL above allows all other traffic to enter the router interface and be passed onto the network.
Once the ACL is built, you just need to apply it to the VLAN interfaces for both networks that the systems are connected to.
You could also configure the RIP process to not advertise routes out to the VLAN that these systems are connected to by using the command passive-interface VLAN 100 under the router rip configuration. This will likely result in the systems not getting any routes and will not communicate to the network unless they have a default route setup within their system. Be careful with this one if you need to advertise routes out to another router on this subnet as it will stop all routing updates from going out that interface. When the Unix users call and say they can't get to the network, have them ping the router interface. Since it is on the same subnet, it will respond. That shows that they have network connectivity so it must be they don't have a default gateway setup. Then tell them that all they need to do is configure a default gateway within their system and while they are at it, they can shutoff the routed process.
HTH
Steve
