Deny access by IP.

[captawol7]

Is there a method of preventing a device with an IP address of 172.25.*.1 (* = any number) from being allowed on the network? The problem I am facing is the end user incorrectly configuring a device and using the .1 gateway address. We run DHCP and have multiple vlans. Our 'edge' switches are 3500XL, 2950 and 2960's.

I have thought about 802.1x but then all the devices must run a suplicant/client in order to connect and some devices are not capable of doing this.

The ideal solution would be the ability to detect the fraudulant gateway address on the edge port and disable the port.

[Sureshdank]

You need to have L3 deivce for doing so. ACLs can be implemented on the interfaces which can block any ip address and any protocol.

[captawol7]

That is what I thought, but didn't know if I was missing some hidden trick that exists.