0

I maintain a small LAN (192.168.1.0/24) on which we have several untrusted machines, where the users of those machines have administrative rights or are able to connect their own machines to the network.

The server is also on that network (192.168.1.200) and I need to prevent an IP conflict from taking down network services when the user sets his machine's IP the same as the server (possibly maliciously).

I've though about breaking the netowrk into two (something like 192.168.1.0/25 and 192.168.1.128/25).

What's the best way to keep services up?

4
  • 7
    You take away the user's admin/root privileges to set a static IP. Barring that, you explain to the all of 15 people in your office not to set a static IP to 192.168.1.200. If they do it at that point, it's a disciplinary issue. This isn't that hard.
    – TheCleaner
    Dec 19, 2013 at 21:15
  • TheCleaner: any person with a mobile can set static IP address of its smartphone.
    – Pol Hallen
    Dec 19, 2013 at 21:17
  • Only if you allow them to connect to WiFi. Don't do that, either. If this happens frequently, try communicating with the users. Most places have a AUP (Acceptable Use Policy) that explains what they are, and are not, allowed to do with devices on the network.
    – mfinni
    Dec 19, 2013 at 21:29
  • 1
    @PolHallen - then you give them a metaphorical smackdown every time they do it Dec 19, 2013 at 21:30

3 Answers 3

10

Move your servers to a separate VLAN - this will mitigate although there is nothing preventing the user from setting his IP to that of the gateway. Or better, move the problem user to his own VLAN.

This can also be solved by using dynamic arp inspection on a good enough managed switch.

This can also be solved by treating it as a disciplinary problem that needs to be addressed at that layer.

Failing that, a Nailbat may be the last resort.

0
2

The technical solution to this sort of problem is 802.1x, but that's probably overkill for this situation.

Make your users trust DHCP and/or don't allow them to modify their IP settings.

1

If he knows the IP, and has rights to change the IP address of a machine, there is not much you can do. You could look at playing around with IP Source guard with DHCP Snooping to force the user to use DHCP.

2
  • Maybe I can work on static arp tables?
    – Pol Hallen
    Dec 19, 2013 at 21:20
  • 3
    No, don't do that.
    – mfinni
    Dec 19, 2013 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .