Enabling Dhcp-Request Message Attack Protection; Configuring Dhcp Packet Rate Limit - HP 10500 Series Configuration Manual
Layer 3 - ip services
Hide thumbs
Also See for 10500 Series:
- Security configuration manual (596 pages) ,
- Configuration manual (512 pages) ,
- Specifications (42 pages)
Table of Contents
Advertisement
To enable MAC address check:
Step
1.
Enter system view.
2.
Enter interface view.
3.
Enable MAC address check.
Enabling DHCP-REQUEST message attack
protection
Attackers may forge DHCP-REQUEST messages to renew the IP address leases for legitimate DHCP
clients that no longer need the IP addresses. These forged messages keep a victim DHCP server renewing
the leases of IP addresses instead of releasing the IP addresses. This wastes IP address resources.
To prevent such attacks, enable DHCP-REQUEST message check on DHCP snooping devices. This feature
uses DHCP snooping entries to check incoming DHCP-REQUEST message. If a matching entry is found
for a message, the DHCP snooping device compares the entry with the message information.
If they are consistent, the DHCP-REQUEST message is considered as a valid lease renewal request
•
and forwarded to the DHCP server.
If they are not consistent, the message is considered as a forged lease renewal request and
•
discarded. If no matching entry is found, the message is considered valid and forwarded to the
DHCP server.
Enable DHCP-REQUEST check only on Layer 2 Ethernet interfaces, and Layer 2 aggregate interfaces.
To enable DHCP-REQUEST message check:
Step
1.
Enter system view.
2.
Enter interface view.
3.
Enable
DHCP-REQUEST
check.
Configuring DHCP packet rate limit
To identify DHCP packets from unauthorized DHCP servers, DHCP snooping delivers all incoming DHCP
packets to the CPU. If a malicious user sends a large number of DHCP requests to the DHCP snooping
device, the CPU of the device is overloaded, and the device may even crash. To solve this problem,
configure DHCP packet rate limit on relevant interfaces.
Follow these guidelines when you configure DHCP packet rate limit:
Configure DHCP packet rate limit only on Layer 2 Ethernet interfaces and Layer 2 aggregate
•
interfaces.
Command
system-view
interface interface-type
interface-number
dhcp-snooping check mac-address
Command
system-view
interface interface-type
interface-number
dhcp-snooping check
request-message
80
Remarks
N/A
N/A
Disabled by default.
Remarks
N/A
N/A
Disabled by default.
Advertisement
Table of Contents
Troubleshooting
