Chapter 12
| Security Measures
DHCP Snooping
– 382 –
DHCP Snooping Option 82
â—† DHCP provides a relay mechanism for sending information about its DHCP
clients or the relay agent itself to the DHCP server. Also known as DHCP Option
82, it allows compatible DHCP servers to use the information when assigning IP
addresses, or to set other services or policies for clients. It is also an effective
tool in preventing malicious network attacks from attached clients on DHCP
services, such as IP Spoofing, Client Identifier Spoofing, MAC Address Spoofing,
and Address Exhaustion.
â—† DHCP Snooping must be enabled for Option 82 information to be inserted into
request packets.
â—† When the DHCP Snooping Information Option 82 is enabled, the requesting
client (or an intermediate relay agent that has used the information fields to
describe itself) can be identified in the DHCP request packets forwarded by the
switch and in reply packets sent back from the DHCP server. This information
may specify the MAC address or IP address of the requesting device (that is, the
switch in this context).
By default, the switch also fills in the Option 82 circuit-id field with information
indicating the local interface over which the switch received the DHCP client
request, including the port and VLAN ID. This allows DHCP client-server
exchange messages to be forwarded between the server and client without
having to flood them to the entire VLAN.
â—† If DHCP Snooping Information Option 82 is enabled on the switch, information
may be inserted into a DHCP request packet received over any VLAN
(depending on DHCP snooping filtering rules). The information inserted into
the relayed packets includes the circuit-id and remote-id, as well as the
gateway Internet address.
â—† When the switch receives DHCP packets from clients that already include DHCP
Option 82 information, the switch can be configured to set the action policy for
these packets. The switch can either drop the DHCP packets, keep the existing
information, or replace it with the switch’s relay information.
DHCP Snooping
Configuration
Use the IP Service > DHCP > Snooping (Configure Global) page to enable DHCP
Snooping globally on the switch, or to configure MAC Address Verification.
Parameters
These parameters are displayed:
◆ DHCP Snooping Status – Enables DHCP snooping globally. (Default: Disabled)
◆ DHCP Snooping MAC-Address Verification – Enables or disables MAC
address verification. If the source MAC address in the Ethernet header of the
packet is not same as the client's hardware address in the DHCP packet, the
packet is dropped. (Default: Enabled)
To Next Page
Loading...
Need help?
General