Question : Problem: Is there a way to do mac address filtering

We have a 3750 that functions as our core switch, also we have the Cisco WLC 4400.

On our DHCP scope we only allow for IP address 192.168.2.xxx-192.168.3.xxx
Our Servers and other static items are on VLAN 2. Our Faculty wireless is on VLAN 2
Our students are on VLAN 20. However we had a teacher bring her laptop from home with a static IP which conflicted with our mail server.

So I guess this question is 2-fold.

Can you just mac address  filter an IP address to a MAC address in a switch so no one can use it but that server. I know you can do this in Windows DHCP scope. Also can you go to the controller to not allow certain IP address on the wireless network?

I am thinking however that maybe the wireless needs it's own VLAN also.

Answer : Problem: Is there a way to do mac address filtering

I'm going to restate your questions so I'm sure I understand.

Question 1: Can you configure a switch in such a way that it blocks traffic from a specified IP address if that IP does not resolve to a specified MAC address?

The 3550 supports something like that.  The command is:
ip source binding vlan interface

Although like the above suggestion that would be per-port, and it sounds like your concern is that another device might be plugged into your switch with the same IP as your server, right?  I don't know why that would happen (it sounds like your server room needs better locks), but you could probably stop that by setting a static ARP entry on your switch, so your server's MAC would always resolve to its IP.  Then hopefully your other switches would be on different VLANs, so a device impersonating your server would hit your core router and its IP wouldn't make any sense, so it couldn't go anywhere.

Question 2: Can you block wireless access by IP?

Sort of? You are right about the VLAN idea - set up a wireless access VLAN, assign it to a completely separate subnet, and then you can control access with ACLs.    All wirless clients would be on, say, 10.1.x.x/16, and anyone on a different subnet would get dropped by the router.  

Of course, if you're just assigning your wireless client addresses with DHCP, then this won't help you at all.  If you really want the AP to filter - most of them filter by MAC alone, since they're generally pretty layer-2 devices.  If you want something a little more flexible, there's always 802.1x, which integrates pretty with Active Directory through RADIUS and EAP.
Random Solutions  
 
programming4us programming4us