MAC binding

[Bikas Giri]

Hi,

I have got only one catalyst 2960 series switch. I have connected different computers/laptops through this switch. I am facing a problem  of ip conflict as the user themselves changes the IP address. For the control of this I can segregate the network by giving one different port of manageable switch to different department. For example I can connect all the computers of account department to a normal switch and the normal switch to an specific port of manageable switch so that I can apply access-list, giving the access to specific ip address through this port. And giving the other port like this to other departments. This can reduce my existing problem. But, for some departments there may be more than 50 computers and the problem rises over here.

Now for this I am looking for the command which can bind ip address and a mac address of a computer, eg. 50 computers ip address binding to each computers mac address by using only one port of manageable switch. Is this possible or not or do I have to assign a single port for a single computer. If so I have to invest a lot of money.

Can anybody suggest me better idea.

With best regards,

Bikas

[Reza Sharifi]

Hi,

Why don't you put different department in different vlans and restrict the vlans by using ACLs. Also, restrict the users from having admin right to the PCs, so they can't change their IPs.

HTH

[Bikas Giri]

Hi,

Its a good idea to give different vlan to each departments. But, some departments have got more than 50 computer and it will be hard to manage conflict. I am compelled to give admin right to most of the PCs. So, is there any other idea so that I can bind ip to mac address.

With best regards,

Bikas

[Reza Sharifi · Accepted solution]

Hi,

There should not be any conflict even if you have more then 50 computers as long as you have enough IPs

example

vlan 10

ip address 192.168.10.1/24

desc department-A

vlan 20

ip address 192.1168.20.1/24

desc department-B

HTH

[cadet alain · Accepted solution]

Hi,

I think you could use the DHCP snooping + IP source guard feature to prevent users from changing their IPs.

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_52_se/configuration/guide/swdhcp82.html