Enabling Dhcp-Request Message Attack Protection; Configuring Dhcp Packet Rate Limit - HP A5120 EI Series Configuration Manual

NOTE:
You can enable MAC address check only on Layer 2 Ethernet interfaces and Layer 2 aggregate
interfaces.
Enabling DHCP-REQUEST message attack
protection
Attackers may forge DHCP-REQUEST messages to renew the IP address leases for legitimate DHCP clients
that no longer need the IP addresses. These forged messages keep a victim DHCP server renewing the
leases of IP addresses instead of releasing the IP addresses. This wastes IP address resources.
To prevent such attacks, you can enable DHCP-REQUEST message check on DHCP snooping devices.
With this feature enabled, upon receiving a DHCP-REQUEST message, a DHCP snooping switch looks up
local DHCP snooping entries for the corresponding entry of the message. If an entry is found, the DHCP
snooping switch compares the entry with the message information. If they are consistent, the DHCP-
REQUEST message is considered a valid lease renewal request and forwarded to the DHCP server. If they
are not consistent, the message is considered a forged lease renewal request and discarded. If no
corresponding entry is found locally, the message is considered valid and forwarded to the DHCP server.
Follow these steps to enable DHCP-REQUEST message check:
To do...
Enter system view
Enter interface view
Enable DHCP-REQUEST
message check
NOTE:
You can enable DHCP-REQUEST message check only on Layer 2 Ethernet interfaces and Layer 2
aggregate interfaces.

Configuring DHCP packet rate limit

To identify DHCP packets from unauthorized DHCP servers, DHCP snooping delivers all incoming DHCP
packets to the CPU. If a malicious user sends a large number of DHCP requests to the DHCP snooping
switch, the CPU of the device will be overloaded, and the device may even crash. To solve this problem,
you can configure DHCP packet rate limit on relevant interfaces.
Follow these steps to configure DHCP packet rate limit:
To do...
Enter system view
Enter interface view
Use the command...
system-view
interface interface-type interface-
number
dhcp-snooping check request-
message
Use the command...
system-view
interface interface-type interface-
number
72
Remarks
—
—
Required
Disabled by default.
Remarks
—
—