The perfect way to resolve IP address conflicts

The method used is to assign IP to the user by DHCP, and then limit the way that these users can only use dynamic IP, if it is changed to static IP mode can not connect to the network; that is, the DHCP snooping function is used.

Example:

Version 12.1

No service pad

Service Timestamps Debug Uptime

Service Timestamps Log uptime

No service password-encryption

Service Compress-config

!

Hostname c4-2_4506

!

Enable Password xxxxxxx!

Clock timezone GMT 8

IP Subnet-zero

No IP domain-lookup

!

IP DHCP snooping VLAN 180-181//To which VLANs are restricted

IP DHCP snooping

ip arp inspection vlan 180-181

ip arp inspection validate src-mac DST-MAC IP

errdisable recovery Cause UDLD

errdisable recovery Cause Bpduguard

errdisable recovery Cause security-violation

errdisable recovery Cause Channel-misconfig

errdisable recovery Cause Pagp-flap

errdisable recovery Cause Dtp-flap

errdisable recovery Cause Link-flap

errdisable recovery Cause L2ptguard

errdisable recovery Cause psecure-violation

errdisable recovery Cause Gbic-invalid

errdisable recovery Cause Dhcp-rate-limit

errdisable recovery Cause Unicast-flood

errdisable recovery Cause Vmps

errdisable recovery Cause arp-inspection

errdisable recovery interval 30

Spanning-tree Extend System-id

!

!

Interface GIGABITETHERNET2/1//restricted to the user of the port access, the switch can be

ip arp inspection limit rate 100

ARP Timeout 2

IP DHCP snooping limit rate 100

!

Interface GIGABITETHERNET2/2

ip arp inspection limit rate 100

ARP Timeout 2

IP DHCP snooping limit rate 100

!

Interface GIGABITETHERNET2/3

ip arp inspection limit rate 100

ARP Timeout 2

IP DHCP snooping limit rate 100

!

Interface GIGABITETHERNET2/4

ip arp inspection limit rate 100

ARP Timeout 2

IP DHCP snooping limit rate 100

Note: DHCP snooping

Dai,dynamic ARP Inspection

IP Source Guard

DHCP Interface Tracker (Option 82)

The device is so limited that the 3550---4000 series can be used to prevent an internal 2-tier attack, and the same VLAN prevents the unauthorized establishment of DHCP SERVER.