HPE FlexNetwork MSR Series Comware 7 Layer 3 - Ip Services Configuration Guides

77
{ Configure an interface that has learned the maximum MAC addresses to discard packets
whose source MAC addresses are not in the MAC address table.
• To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same
source MAC address, you can enable MAC address check on the DHCP relay agent. After you
enable this feature, the DHCP relay agent processes a DHCP request as follows:
{ Directly forwards the DHCP request if the giaddr field is not zero.
{ Compares the chaddr field in the DHCP request with the source MAC address in the frame
header if the giaddr field is zero. If they are the same, the DHCP relay agent forwards the
request to the DHCP server. If they are not the same, the DHCP relay agent discards the
request.
MAC address check takes effect only when the dhcp select relay command has already been
configured on the interface.
A DHCP relay agent changes the source MAC address of DHCP packets before sending them. You
can only enable MAC address check only on the DHCP relay agent directly connected to the DHCP
clients.
A MAC address check entry has an aging time. When the aging time expires, both of the following
occur:
• The entry ages out.
• The DHCP relay agent rechecks the validity of DHCP requests sent from the MAC address in
the entry.
To enable MAC address check:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Set the aging time for MAC
address check entries.
dhcp relay check mac-address
aging-time
time
The default aging time is 30
seconds.
This command takes effect
only after you execute the
dhcp relay check
mac-address
command.
3. Enter the interface view.
interface
interface-type
interface-number
N/A
4. Enable MAC address check.
dhcp relay check mac-address
By default, MAC address
check is disabled.
Configuring the DHCP relay agent to release an
IP address
Configure the relay agent to release the IP address for a relay entry. The relay agent sends a
DHCP-RELEASE message to the server and meanwhile deletes the relay entry. Upon receiving the
DHCP-RELEASE message, the DHCP server releases the IP address.
To configure the DHCP relay agent to release an IP address:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Configure the DHCP relay
agent to release an IP
address.
dhcp relay release ip
ip-address
[
vpn-instance
vpn-instance-name ]
This command can release only
the IP addresses in the recorded
relay entries.

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English