Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I maintain a small LAN (192.168.1.0/24) on which we have several untrusted machines, where the users of those machines have administrative rights or are able to connect their own machines to the network.

The server is also on that network (192.168.1.200) and I need to prevent an IP conflict from taking down network services when the user sets his machine's IP the same as the server (possibly maliciously).

I've though about breaking the netowrk into two (something like 192.168.1.0/25 and 192.168.1.128/25).

What's the best way to keep services up?

share|improve this question
7  
You take away the user's admin/root privileges to set a static IP. Barring that, you explain to the all of 15 people in your office not to set a static IP to 192.168.1.200. If they do it at that point, it's a disciplinary issue. This isn't that hard. –  TheCleaner Dec 19 '13 at 21:15
    
TheCleaner: any person with a mobile can set static IP address of its smartphone. –  Pol Hallen Dec 19 '13 at 21:17
    
Rex, thanks for help :-) –  Pol Hallen Dec 19 '13 at 21:19
    
Only if you allow them to connect to WiFi. Don't do that, either. If this happens frequently, try communicating with the users. Most places have a AUP (Acceptable Use Policy) that explains what they are, and are not, allowed to do with devices on the network. –  mfinni Dec 19 '13 at 21:29
1  
@PolHallen - then you give them a metaphorical smackdown every time they do it –  Mark Henderson Dec 19 '13 at 21:30

3 Answers 3

up vote 10 down vote accepted

Move your servers to a separate VLAN - this will mitigate although there is nothing preventing the user from setting his IP to that of the gateway. Or better, move the problem user to his own VLAN.

This can also be solved by using dynamic arp inspection on a good enough managed switch.

This can also be solved by treating it as a disciplinary problem that needs to be addressed at that layer.

Failing that, a Nailbat may be the last resort.

share|improve this answer
    
Thanks for help! Clear and cool! :-) –  Pol Hallen Dec 19 '13 at 21:31

The technical solution to this sort of problem is 802.1x, but that's probably overkill for this situation.

Make your users trust DHCP and/or don't allow them to modify their IP settings.

share|improve this answer

If he knows the IP, and has rights to change the IP address of a machine, there is not much you can do. You could look at playing around with IP Source guard with DHCP Snooping to force the user to use DHCP.

share|improve this answer
    
Maybe I can work on static arp tables? –  Pol Hallen Dec 19 '13 at 21:20
3  
No, don't do that. –  mfinni Dec 19 '13 at 21:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.