DHCP: force router to assign predefined infinite DHCP address

[Frank Hohenadel]

Does anyone know if its possible to force a router only to assign an infinite DHCP address when a client connect to the network?

In the configuration (2911 router) there is an DHCP server configured which assigns specific IP addresses to certain mac addresses (in this example to Client1 with mac address 00aa.00bb.00cc.ab). Due to security reasons I want to avoid that a user of a device can manually set a different ip address on his device and still be able to use/connect to the router (so far this is possible). 

DHCP config is:

ip dhcp pool data
 network 192.168.2.0 255.255.255.0
 default-router 192.168.2.1 
 dns-server 10.10.10.1 
!
ip dhcp pool Client1
 host 192.168.2.10 255.255.255.0
 client-identifier 00aa.00bb.00cc.ab
 dns-server 10.10.10.1 
 default-router 192.168.2.1 
 

Thanks, Frank

[houtan haddadlarijani]

you can use IP source guard feature along with DHCP snooping  to mitigate such a security threat.

Ip source guard uses DHCP snooping database to test that if incoming packet's source ip is assigned by dhcp server or not, in case of illegal source ip address, the packet will be dropped.

HTH