How to forbid the computer to modify IP casually?
The most direct result of computer modification of IP is that this computer cannot access the Internet. If it is changed to another computer's IP, then the IP will conflict and neither computer will be able to access the Internet. Such a problem is not a big problem, but it is very troublesome, if you want to ban it on this machine, there is a water experience and methods on the Internet, it will not be introduced one by one. But if you run into an employee's own computer, or if the network manager's paw can't reach the computer, what if you manage it at the network level?
1. If you are in a domain environment, it is also easy to disable modification of IP. Each computer is given a fixed IP address and administrator privileges are not open (clients cannot modify it on their own). This scheme can only work on computers, and it is generally used more in local area networks in domain environments. The group policy configuration is shown in the figure.
two。 If you have a core switch, that's fine. Set the IP-MAC binding based on the switch setting switch port. This scheme is the most stringent IP-MAC binding scheme, but requires the switch to have this function, and the configuration is more complex. Take Huawei S5700 switch as an example, static IP is assigned on the DHCP server, so that the client can get the same IP address every time, and the DHCP server can be a router or a switch. Note, however, that DHCP's static address assignment does not prevent manual modification of the IP to bypass the binding. Therefore, it is generally necessary to use it in conjunction with other means.
Binding Scheme of 3.WFilter-NGF
WFilterNGF and the WSG online behavior management gateway based on this system not only have the static IP allocation function of DHCP, but also can do IP-MAC verification. The functions of "static IP allocation" and "IP-MAC binding" can be implemented without other devices, and IP-mac binding across VLAN can also be performed. The configuration is as follows:
4. The above three methods are more professional network methods. If the environment is simple and there are no these devices, then take a look at your routing. Many routes have the function of binding IP and MAC, but they all function for this function. Once you cross the network segment (or have a wireless Internet environment) or are not in the scope of IP management, then the function is meaningless.
