deny mismatch ip to mac-address

[jpl861]

Hi,

I need to configure an access-list that will permit a workstation to browse specific website only and will deny all traffic.

The router is configured as the dhcp server. I will create an ip-to-macaddr reserveration for that workstation.

What I need to do is to block the workstation if the mac-address is not corresponding to a specific ip address because he might configure a static ip address that will give him access to all resources.

please help. thanks.

[criss_noh]

To prevent from static IP address, you should use DHCP snooping including ARP inspection.

[bjw]

Or use port security and hard code the MAC address you know is the "official" station MAC address. You can configure port security to shutdown the port if the MAC address changes.

http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a008019f030.html

And as the last submitee mention IP DHCP SNOOPING is another good layer.

Then an ACL on the router and bam!!!!

Security Soup!