Hi Thomas, your concept sounds correct.
This is how this works
Assuming your topology is this-
Internet -> Router -> Core switch (no client/customer) -> Access switch -> Client/customer
For argument sake, your uplink from access switch is port 18 which connects to port 18 of the core switch
Problem statement-
On access switch, your desire is to have a client or customer connect to the switch using a specific MAC address and IP address and no other
Possible solutions-
Dynamic ARP inspections statically MAPS and IP address to a MAC address, any connection using the same MAC but different IP will be dropped and any connection using the same IP but different MAC will be dropped
Create an access list to permit only the desire IP address on the INGRESS port and block any other traffic to that port
Solution work flow-
Enable dynamic ARP inspection
Security -> ARP inspection -> Properties -> Enable
Enable trusted interfaces - These interfaces will allow any traffic and not subject to your inspection list. Untrusted is subject to the inspect list
Security -> ARP Inspection -> Interface Settings -> Edit interfaces as desired
Build your inspection table
Security -> ARP inspection -> ARP access control -> Add ->
-Control name is an arbitrary value, it is a description
-IP address is the IP you want in the database
-MAC address is the binding to the IP address for the switch to look up in the data
If DAI is too stringent for you, you may create an access list as an alternative solution
Access Control -> IPV4 based ACL -> Add
-ACL Name is what you want to call it, a description -> Apply
Next define the access list by going to IPV4 ACE bu click IPV4-based ACE -> Add
-Priority is an ordering system, you should structure your rules in an order for the switch to look up the rules
-Action permit or deny, in your case you want to permit
-Protocol will be IP (all traffic)
-Source IP address will be your host connection 100.100.12.34
-Wildcard mask will be 0.0.0.0 (this is a single host wild card)
-Destination will be Any
Click apply
Once the access list is built, it then gets bound to an interface. The interface must be the interface where the traffic goes to and not leaving
Access Control -> ACL Binding (port)
-Check box for the port your customer/client connects
-Interface is where the customer/client connects to the switch
-Check box for Select IPV4-Based ACL
-Default action is Deny Any
-Apply
With this completed correctly, only your IP for all traffic will connect to that port and any other IP will not be allowed, will discard if connection through that same port.
-Tom
Please mark answered for helpful posts
-Tom
Please mark answered for helpful posts
http://blogs.cisco.com/smallbusiness/
