Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are implementing a security policy and Firewall access rules based on the subnet using static dhcp bindings.

There is one scenario where some one can manually assign ip address from a subnet with higher access privileges.

Any suggestion how to cater for such eventuality.

share|improve this question

closed as not constructive by Jim B, Shane Madden, MDMarra, Scott Pack, Michael Hampton Dec 16 '12 at 23:53

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

What os? Question needs more details – Jim B Jan 25 '12 at 2:38

Ideally you would have physical control of the machines on the network and disallow regular users from configuring networking.

If anyone can just come and plug in you will need to look at things like whitelisting mac addresses in the network switches.

Also, take a look at 802.1X if you don't mind a complicated setup

share|improve this answer

If your networking equipment (switches/routers) supports it, you should consider using a separate VLAN for each subnet.

This will mean that each subnet is logically separated and that users who change their IP address will be unable to establish connections, as return packets will be routed somewhere else.

You should also make sure you turn on ingress filtering on your routing equipment.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.