SG300-20 configure 1 ip pr port

Question

We got 1 customer that would like us to configure a system based on SG300-20 linked up with an SG300-10SFP using trafficshaping ingress and egress limited to 40mbit.
This part of the case is solved using ingress/egress 40960 with an burtlimit a bith higher.
But he also wants each firewall configured on the net to only be able to have 1 ip on that spesific port.
this is an owner of a building that rents out to other companies. Each comapny is assinged a port on the SG300-20 and has theire own ip  (ie 100.100.12.34)  all of them are part of a /26 net and would use the same Gateway.
Is this possible ? 
that the company assigned to ie port 14 in switch 1 only can use 100.100.12.34/26 gw 100.100.12.1 and if they change to 100.100.12.36 it will not work.  This to prevent the endusers from changing and fu...g up the net for the rest :-)
and on port 16 on switch 1 they can only use 100.100.12.36/26 with gw 100.100.12.1
thnsk for any input
switches are in layer2 mode , but nothing is in production yet so i can change ot layer3 if thats what it takes.
regard
Thomas                 

Answer 1

Hi Thomas, your concept sounds correct.
This is how this works
Assuming your topology is this-
Internet -> Router -> Core switch (no client/customer) -> Access switch -> Client/customer
For argument sake, your uplink from access switch is port 18 which connects to port 18 of the core switch
Problem statement-
On access switch, your desire is to have a client or customer connect to the switch using a specific MAC address and IP address and no other
Possible solutions-
Dynamic ARP inspections statically MAPS and IP address to a MAC address, any connection using the same MAC but different IP will be dropped and any connection using the same IP but different MAC will be dropped
Create an access list to permit only the desire IP address on the INGRESS port and block any other traffic to that port
Solution work flow-
Enable dynamic ARP inspection
Security -> ARP inspection -> Properties -> Enable
Enable trusted interfaces - These interfaces will allow any traffic and not subject to your inspection list. Untrusted is subject to the inspect list
Security -> ARP Inspection -> Interface Settings -> Edit interfaces as desired
Build your inspection table
Security -> ARP inspection -> ARP access control -> Add ->
-Control name is an arbitrary value, it is a description
-IP address is the IP you want in the database
-MAC address is the binding to the IP address for the switch to look up in the data
If DAI is too stringent for you, you may create an access list as an alternative solution
Access Control -> IPV4 based ACL -> Add
-ACL Name is what you want to call it, a description -> Apply
Next define the access list by going to IPV4 ACE bu click IPV4-based ACE -> Add
-Priority is an ordering system, you should structure your rules in an order for the switch to look up the rules
-Action permit or deny, in your case you want to permit
-Protocol will be IP (all traffic)
-Source IP address will be your host connection 100.100.12.34
-Wildcard mask will be 0.0.0.0  (this is a single host wild card)
-Destination will be Any
Click apply
Once the access list is built, it then gets bound to an interface. The interface must be the interface where the traffic goes to and not leaving
Access Control -> ACL Binding (port)
-Check box for the port your customer/client connects
-Interface is where the customer/client connects to the switch
-Check box for Select IPV4-Based ACL
-Default action is Deny Any
-Apply
With this completed correctly, only your IP for all traffic will connect to that port and any other IP will not be allowed, will discard if connection through that same port.
-Tom
Please mark answered for helpful posts