Restrict port to specific range of IP addresses?

[donohoecompanies]

All my access switches are 2960X, and I'd like to restrict all the ports to only allow IP addresses in a specific range to connect to the port. I want this to insure only IPs in the client range can actually be on those ports.

I'm planning on also configuring IP Source Guard, but that won't protect against someone manually changing the IP addresses on the client to something outside the allowed client range.

I'm pretty sure this can be done, but so far I haven't been able to find out ho

[marce1000]

 - Note that switch-ports basically handle layer 2 traffic which they can perfectly do from a device that doesn't even have an IP address. In this the usual debate arises from controller network management versus I-don't-know-what-is-going-on. Personally I prefer the first approach implemented through well configured DHCP servers (e.g.) , so that you question 'becomes no longer needed'.

 M.

[kubn2]

Hi,

Dynamic ARP inspection which relies on DHCP snooping building database with bindings mac to ip addresses. So if user will change his ip address switch will drop those packets because bindings in DHCP snooping database will not match.

[paul driver]

Hello

---

@donohoecompanies wrote:

All my access switches are 2960X, and I'd like to restrict all the ports to only allow IP addresses in a specific range to connect to the port. I want this to insure only IPs in the client range can actually be on those ports.

Just to clarify and if possible elaborate?
 Do you mean these ports are able to reach this specific ip range or these ports are allowcated ip addressing from a specific ip range?

[donohoecompanies]

---

@paul driver wrote:

 Do you mean these ports are able to reach this specific ip range or these ports are allowcated ip addressing from a specific ip range?

---

The ports are allocated IP addressing from a specific IP range.

[balaji.bandi]

For now, i can only think of DHCP with IP reserved and MAC ACL to protect.