Table of Contents
Advertisement
switch is rebooting, when the switch receives a DHCP DISCOVERY or REQUEST message, the
clientʹs binding will go to a tentative binding state.
Rate Limiting
To protect the switch against DHCP attacks when DHCP snooping is enabled, the snooping
application enforces a rate limit for DHCP packets received on untrusted interfaces. DHCP
snooping monitors the receive rate on each interface separately. If the receive rate exceeds a
configurable limit, DHCP snooping brings down the interface. Use the set port enable command
to re‐enable the interface. Both the rate and the burst interval can be configured.
Basic Configuration
The following configuration procedure does not change the write delay to the snooping database
or any of the default rate limiting values. Additional configuration notes follow this procedure.
Procedure 17-1 Basic Configuration for DHCP Snooping
Step
Task
1.
Enable DHCP snooping globally on the switch.
2.
Determine where DHCP clients will be
connected and enable DHCP snooping on their
VLANs.
3.
Determine which ports will be connected to the
DHCP server and configure them as trusted
ports.
4.
If desired, enable logging of invalid DHCP
messages on specfic ports.
5.
If desired, add static bindings to the database.
Configuration Notes
DHCP Server
•
When the switch is operating in switch mode, then the DHCP server and DHCP clients must
be in the same VLAN.
•
If the switch is in routing mode (on those platforms that support routing), then the DCHP
server can be remotely connected to a routing interface, or running locally.
•
If the DHCP server is remotely connected, then the use of an IP helper address is required and
MAC address verification should be disabled (set dhcpsnooping verify mac‐address
disable).
•
The DHCP server must use Scopes in order to provide the IP addresses per VLAN.
•
DHCP snooping must be enabled on the interfaces where the DHCP clients are connected,
and the interfaces must be untrusted DHCP snooping ports.
•
The routing interface that is connected to the DHCP server must be enabled for DHCP
snooping and must be a trusted DHCP snooping port.
DHCP Snooping Overview
Command(s)
set dhcpsnooping enable
set dhcpsnooping vlan vlan-list
enable
set dhcpsnooping trust port
port-string enable
set dhcpsnooping log-invalid port
port-string enable
set dhcpsnooping binding mac-address
vlan vlan-id ipaddr port port-string
SecureStack C2 Configuration Guide 17-3
Advertisement
Table of Contents
