2

I know the title is not the best possible title.

Currently, every server on my network may use any static IP by simply configuring it in the OS level. What I'm trying to accomplish is allowing a specific IP address only be used with a specific MAC address.

So for example, I should be able to set 192.168.1.1 and 192.168.1.2 can only be used by the MAC address 00:fe:94:82:05:32.

If another NIC, with a different MAC address, let's say 00:fe:94:82:05:31, wants access to use 192.168.1.1 or 192.168.1.2, something should deny its request. What would that something be? I assume it should be the router or a level 3 switch. If so, what feature should I search for in specs of routers to buy?

Improve this question
4
  • 1
    Is this about security? If so you should be aware that finding out the MAC of the device you're trying to impersonate and setting your device to use that MAC is trivial.
    – Cory J
    Mar 8, 2013 at 18:23
  • It's a virtualization environment. I'm not sure the owner of the virtual machine can change its MAC
    – ispirto
    Mar 8, 2013 at 18:26
  • Then if I were you, I'd find out for sure before I built an entire security edifice about the proposal that they can't. You're busily rejecting a whole bunch of normal suggestions (eg via the DHCP server) on the basis that the end-user can easily bypass them; if that turns out to be true for MAC addresses as well, as I strongly suspect it is, you're wasting a lot of time here.
    – MadHatter
    Mar 9, 2013 at 7:36
  • @ispirto Every virtualisation hypervisor can be configured to use arbirary MAC addresses. It may not be obvious how to do it. In some cases it's not even in the manual, but it is always possible. If you can't control the hyper-visor you are asking for the impossible as MAC-addresses are NOT fixed..
    – Tonny
    Mar 9, 2013 at 10:28

4 Answers 4

Reset to default
3

You would need an intelligent switch to do this on the network. I don't know if there is a VM management tool that can prevent users from adding another or changing IP's on their guest.

In Cisco-land you're looking for port-security to keep someone on a different port from spoofing the mac, and IP source guard (IPSG) to inspect the mac/IP combination and/or dynamic arp inspection (DAI) to prevent ARP spoofing. IPSG and DAI depend on DHCP snooping or a user-configured table, so it can add quite the overhead to your operation.

Other vendors(Juniper/Extreme/Force10/etc...) can do the same security features but the names might differ from what I mentioned. All vendors will have their own hardware/software/licensing requirements that you will need to work out with your vendor/VAR.

Also, there are complications to configuring this type of security and a misconfiguration can be really hard to troubleshoot, and depending on your network it might not be possible to provide this level of security.

Improve this answer
2

Do you have anything handing out IPs on your 192.168.1.X network?

If you are using a DHCP server, you can create a DHCP reservation, which locks a MAC address to a specific IP. The servers would be set to use DHCP and when contacting the DHCP server will pull the reserved address for that host.

You could potentially create static ARP entries for each IP - MAC on your router. However, that would just prevent Layer 3 communication from a host that tries using an address not matched to it's MAC. To prevent all communication you would need to create static ARP entries in every host in the Layer 2 domain the host could need to communicate with and prevent people from being able to change those entries (sounds like a management nightmare to me).

Improve this answer
4
  • No, there is no DHCP server. However, it's not relevant. I know I can simply static map on the DHCP server conf to hand out the right IPs to the right MAC addresses. However, it's not the case. What I'm looking for a strict environment.
    – ispirto
    Mar 8, 2013 at 18:24
  • It is relevant because that is how you specify that a MAC gets a specific IP. What do you mean by a "strict" environment? The "something should deny it" would be your DHCP server. Even still if the people managing the servers have rights to access TCP/IP properties they could still change to a static IP.
    – HostBits
    Mar 8, 2013 at 18:32
  • I meant, even they want to use a static IP of 192.168.1.1, they shouldn't be able to that, by strict.
    – ispirto
    Mar 8, 2013 at 18:37
  • This would not work as the network gear will not enforce such binding, and setting the IP address manually will circumvent your solution.
    – Martino Dino
    Mar 9, 2013 at 9:05
2

Mate, if you really have this sort of environment, the only answer to your problem is a well defined Policy of what may and may not be done.

There is no technology capable of doing what you need. Port protection, firewall matching the pair MAC/IP or whatever other solution won't prevent the owner of the VM to simply change it's IP Address.

But a real policy, with clear rules and punitive to who break it, will have more effect to it.

Improve this answer
1
  • Agree, no technical solution is 100% reliable and will be very complicated and expensive. And you still need a policy in place. Might as well go policy only, with frequent checks (can be easily automated) if everyone plays by the rules.
    – Tonny
    Mar 9, 2013 at 10:31
1

How can they use "any static IP"? If you have a static IP set then that's what it uses. Once you set the Static IP you should keep it and document it for each server.

"Internet Protocol addresses are assigned to a host either anew at the time of booting, or permanently by fixed configuration of its hardware or software. Persistent configuration is also known as using a static IP address"

So are you using static IPs or DHCP? Or are you just in a lab environment that you're changing IPs all the time?

I guess my suggestion is setting up a specific VLAN with the servers you want to keep static IP addresses and then putting the ones that are changing on another VLAN.

Improve this answer
8
  • I'm not managing every server on the network, so the owners can simply configure a static IP on their server and use 192.168.1.1. I'm trying to disallow that.
    – ispirto
    Mar 8, 2013 at 18:21
  • 3
    You can't control what IP people set on the equipment under their control.
    – Cory J
    Mar 8, 2013 at 18:24
  • Yeah I understand that but if you're in an organization that has a bunch of servers I assume there is some sort of policy enforcement? You're not about to walk into my building and set up a server using what ever IP you want. Although if you are in a position that allows people to do that then I think a VLAN would be your best bet. If it's just the two you need then make a vlan with just 192.168.1.0 /30 and put everyone else on a different vlan
    – Ericrobert
    Mar 8, 2013 at 18:35
  • @Ericrobert - I was responding to the comment. Your suggestion is perfectly valid.
    – Cory J
    Mar 8, 2013 at 18:39
  • 2
    That depends on this virtual machine network setup. If they are all clustered and have a central management point such as vCenter Server you should be able to configure the virtual network to separate those servers into their own vlan / network. You can't configure a network properly that you don't have authority over though. I'm trying to wrap my head around what sort of infrastructure/organization would have 120 VMs that don't have dedicated static IP schemes and are un-managed by a central entity.
    – Ericrobert
    Mar 8, 2013 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.