Huawei Quidway S9300 Configuration Manual page 158

3 DHCP Snooping Configuration
l
l
Procedure
Step 1 Enable DHCP snooping.
# Enable DHCP snooping globally.
<Quidway> system-view
[Quidway] dhcp enable
[Quidway] dhcp snooping enable
# Enable DHCP snooping on the interface at the user side.
[Quidway] interface gigabitethernet 1/0/0
[Quidway-GigabitEthernet1/0/0] dhcp snooping enable
[Quidway-GigabitEthernet1/0/0] quit
Step 2 Configure the interface as trusted.
# Configure the interface connecting to the DHCP server as trusted and enable DHCP snooping
on the interfaces connecting to the DHCP client. If the interface on the client side is not
configured as trusted, the default mode of the interface is untrusted after DHCP snooping is
enabled on the interface. This prevents bogus DHCP server attacks.
[Quidway] interface gigabitethernet 2/0/0
[Quidway-GigabitEthernet2/0/0] dhcp snooping trusted
[Quidway-GigabitEthernet2/0/0] quit
Step 3 Enable the checking for certain types of packets and configure the DHCP snooping binding table.
# Enable the checking of DHCP Request messages on the interface at the DHCP client side to
prevent attackers from sending bogus DHCP messages for extending IP address leases.
[Quidway] interface gigabitethernet 1/0/0
[Quidway-GigabitEthernet1/0/0] dhcp snooping check user-bind enable
[Quidway-GigabitEthernet1/0/0] quit
# Enable the checking of the CHADDR field on the interface at the DHCP client side to prevent
attackers from changing the CHADDR field in DHCP Request messages.
[Quidway] interface gigabitethernet 1/0/0
[Quidway-GigabitEthernet1/0/0] dhcp snooping check mac-address enable
[Quidway-GigabitEthernet1/0/0] quit
Step 4 Configure the DHCP snooping binding table.
# If you use the static IP address, configuring DHCP snooping static entries is required.
[Quidway] user-bind static ip-address 10.1.1.1 mac-address 0001-0002-0003
interface gigabitethernet 1/0/0 vlan 10
Step 5 Limit the rate of sending DHCP messages
# Check the rate of sending DHCP messages to prevent attackers from sending DHCP Request
messages.
3-48
Alarm threshold of the number of discarded packets being 120
Alarm threshold for checking the rate of sending packets being 80
NOTE
This configuration example provides only the commands related to the DHCP snooping configuration.
For the configuration of DHCP Relay, see Configuring the DHCP Relay Agent in Quidway S9300 Terabit
Routing Switch Configuration Guide - IP Service.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
Quidway S9300 Terabit Routing Switch
Configuration Guide - Security
Issue 06 (2010–01–08)