Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had an issue today where someone set a static IP on a test machine which happened to be my internet gateway. They then hooked to the primary network and screwed up outbound internet traffic.

I understand how to set up IP reservations in dhcp but I am not sure that will help me here since this was a static address.

Is there anything I can do at the domain level to prevent issues like this in the future?

share|improve this question
up vote 1 down vote accepted

Barring educating the users I can only think of one thing: Add a fixed ARP address for that IP on managed switches.

And document it, since it is going to be fun when you replace the gateway.

Edit: I just realized that that solves the specific problem you had, but not the question in in title. Well, not unless you add a lot of fixed ARP entries to your switches. And that is something to avoid.

share|improve this answer
I think for this case that will do. I would only have one or two entries I would want to set up like that to protect them from re-use. Thanks for your thoughts on my issue Hennes! – TWood Sep 27 '12 at 16:22
Why resort to something as drastic as user-education when user-beatings work just as well, if not better? – HopelessN00b Sep 27 '12 at 16:55

Nothing inherent in AD will help you here.

But, if you are using Cisco switches then you want [IP Source Guard][1], which is a complement to DHCP snooping. If a device does not receive an address for DHCP or tries to use an IP address not assigned via DHCP, the packet is dropped (or the port is disabled, depending on your iOS version).

I'm sure other switch vendors have similar features.

share|improve this answer

Not domain level (can't think of anything else domain ralted than not to let user use static IPs), but can you set up a firewall between test and production networks? Then you could drop incorrect traffic.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.