Setting The Maximum Number Of Dhcpv6 Snooping Entries; Enabling Dhcpv6-Request Check - HP 6125XLG Layer 3-Ip Services Configuration Manual

Step
3. (Optional.) Manually save
DHCPv6 snooping entries
to the database file.
4. (Optional.) Set the amount
of time to wait to update
the database file after
DHCPv6 snooping entry
changes.
Setting the maximum number of DHCPv6 snooping
entries
Perform this task to prevent the system resources from being overused.
To set the maximum number of DHCPv6 snooping entries:
Step
1. Enter system view.
2. Enter interface view.
3. Set the maximum number
of DHCPv6 snooping
entries for the interface to
learn.

Enabling DHCPv6-REQUEST check

Perform this task to use the DHCPv6-REQUEST check function to protect the DHCPv6 server against
DHCPv6 client spoofing attacks. Attackers can forge DHCPv6-RENEW messages to renew leases for
legitimate DHCPv6 clients that no longer need the IP addresses. The forged messages disable the victim
DHCPv6 server from releasing the IP addresses. Attackers can also forge DHCPv6-DECLINE or
DHCPv6-RELEASE messages to terminate leases for legitimate DHCPv6 clients that still need the IP
addresses.
The DHCPv6-REQUEST check function enables the DHCPv6 snooping device to check every received
DHCPv6-RENEW, DHCPv6-DECLINE, or DHCPv6-RELEASE message against DHCPv6 snooping entries.
If any of the criteria in an entry is matched, the device compares the entry with the message
•
information.
If they are consistent, the device considers the message valid and forwards it to the DHCPv6
server.
If they are different, the device considers the message forged and discards it.
If no matching entry is found, the device forwards the message to the DHCPv6 server.
•
To enable DHCPv6-REQUEST check:
Command
ipv6 dhcp snooping
binding database update
now
ipv6 dhcp snooping
binding database update
interval seconds
Command
system-view
interface interface-type
interface-number
ipv6 dhcp snooping
max-learning-num number
196
Remarks
DHCPv6 snooping entries are saved to the
database file each time this command is
executed.
The default setting is 300 seconds.
When a DHCPv6 snooping entry is learned or
removed, the device does not update the
database file until after the specified waiting
period. All changed entries during that period
will be updated.
Remarks
N/A
N/A
By default, the number of DHCPv6
snooping entries for an interface to
learn is not limited.