Edge-Core ECS4620-28P User Manual

Chapter 9 | General Security Measures
DHCPv6 Snooping
– 353 –
◆ When enabled, DHCPv6 messages entering an untrusted interface are filtered
based upon dynamic entries learned via DHCPv6 snooping.
◆ Table entries are only learned for trusted interfaces. Each entry includes a MAC
address, IPv6 address, lease time, binding type, VLAN identifier, and port
identifier.
◆ When DHCPv6 snooping is enabled, the rate limit for the number of DHCPv6
messages that can be processed by the switch is 100 packets per second. Any
DHCPv6 packets in excess of this limit are dropped.
◆ Filtering rules are implemented as follows:
■
If global DHCPv6 snooping is disabled, all DHCPv6 packets are forwarded.
■
If DHCPv6 snooping is enabled globally, and also enabled on the VLAN
where the DHCPv6 packet is received, DHCPv6 packets are forwarded for a
trusted port as described below.
■
If DHCPv6 snooping is enabled globally, and also enabled on the VLAN
where the DHCP packet is received, but the port is not trusted, DHCP
packets are processed according to message type as follows:
DHCP Client Packet
■
Request: Update entry in binding cache, recording client’s DHCPv6
Unique Identifier (DUID), server’s DUID, Identity Association (IA) type, IA
Identifier, and address (4 message exchanges to get IPv6 address), and
forward to trusted port.
■
Solicit: Add new entry in binding cache, recording client’s DUID, IA type,
IA ID (2 message exchanges to get IPv6 address with rapid commit
option, otherwise 4 message exchanges), and forward to trusted port.
■
Decline: If no matching entry is found in binding cache, drop this
packet.
■
Renew, Rebind, Release, Confirm: If no matching entry is found in
binding cache, drop this packet.
■
If the DHCPv6 packet is not a recognizable type, it is dropped.
If a DHCPv6 packet from a client passes the filtering criteria above, it will
only be forwarded to trusted ports in the same VLAN.
DHCP Server Packet
■
If a DHCP server packet is received on an untrusted port, drop this
packet and add a log entry in the system.

Edge-Core ECS4620-28P Specifications

General

Brand	Edge-Core
Model	ECS4620-28P
Category	Switch
Language	English