How to prevent intranet users from changing IP configuration cases in PIX or ASA

Prevent intranet users from messing with the IP address, users can only use the given IP, if the IP address, you can not access network resources.

For example, after the following configuration (ARP inside 10.64.64.29 000f.b0d8.a504), a PC with a MAC address of 000f.b0d8.a504 can only use ip10.64.64.29 to access network resources, if that IP is inaccessible.

pix515e# sh run
: Saved
:
PIX Version 7.2(1 )
!
hostname pix515e
domain-name cisco
enable password N7FecZuSHJlVZC2P encrypted

Do a name analysis

****************************************************
Names
Name 10.64.64.113 Chengxiaojie
Name 10.64.64.13 DHCP
Name 10.64.64.71 Liuyongjun
Name 10.64.64.72 LIUYONGJUN-IBM
Name 10.64.64.39 Lixiaoliang
Name 10.64.64.103 Lixuesong
Name 10.64.64.17 lulianying
Name 10.64.64.92 Qizuomeng
Name 10.64.64.69 Wangzhili
Name 10.64.64.105 Xingzhonghe
Name 10.64.64.45 Tanjun
Name 10.64.64.108 Zhangyi
Name 10.64.64.178 Hujian
Name 10.64.64.93 ibm220
Name 10.64.64.62 jiling
Name 10.64.64.111 Yangliu
Name 10.64.64.112 Wangsishen
Name 10.64.64.158 Wangyuguo
Name 10.64.64.52 Lishihai
Name 10.64.64.78 Office-teacher
Name 10.64.64.48 Yangjin
Name 10.64.64.104 Wutao
Name 10.64.64.63 Zangdong
Name 10.64.64.80 Xiaoguangyue
Name 10.64.64.14 ibm235
Name 10.64.64.222 Lixuesong-dell
Name 10.64.64.75 Maxiaopeng
Name 10.64.64.215 Lintao
Name 10.64.64.199 Machi
Name 10.64.64.216 Liuxuesong
Name 10.64.64.246 jiachangjing
Name 10.64.64.61 CHUFW
****************************************************
!
Interface Ethernet0
Nameif outside
Security-level 0
IP address x.x.76.26 255.255.255.0
!
Interface Ethernet1
Nameif inside
Security-level 100
IP address 10.64.64.2 255.255.240.0
!
Interface Ethernet2
Nameif DMZ
Security-level 80
IP address 192.168.0.1 255.255.255.0
!
passwd n7feczushjlvzc2p Encrypted
!
Time-range Worktime
Periodic daily 8:00 to 17:00
!
FTP mode passive
Clock timezone CST 8
DNS Domain-lookup outside
DNS Server-group Defaultdns
Name-server 219.150.32.132
Domain-name Cisco

Do Object-group to be invoked in ACLs (note: Object-group is a good thing that can greatly simplify the configuration of ACLs)