Huawei Quidway S2700 Series Configuration Manual page 8

Quidway S2700 Series Ethernet Switches
Configuration Guide - Security
3.4 Preventing the DoS Attack by Changing the CHADDR Field.........................................................................81
3.4.1 Establishing the Configuration Task.......................................................................................................81
3.4.2 Enabling DHCP Snooping.......................................................................................................................82
3.4.3 Checking the CHADDR Field in DHCP Request Messages...................................................................83
3.4.4 Checking the Configuration.....................................................................................................................84
3.5 Preventing the Attacker from Sending Bogus DHCP Messages for Extending IP Address Leases................84
3.5.1 Establishing the Configuration Task.......................................................................................................84
3.5.2 Enabling DHCP Snooping.......................................................................................................................85
3.5.3 Enabling Checking of DHCP Request Messages....................................................................................87
3.5.4 (Optional) Configuring the Option 82 Function......................................................................................87
3.5.5 (Optional) Setting the Format of the Option 82 Field.............................................................................89
3.5.6 (Optional) Appending the Option 18 Field or the Option 37 Field to DHCPv6 Request Messages
..........................................................................................................................................................................90
3.5.7 Checking the Configuration.....................................................................................................................90
3.6 Setting the Maximum Number of DHCP Snooping Users...............................................................................91
3.6.1 Establishing the Configuration Task.......................................................................................................91
3.6.2 Enabling DHCP Snooping.......................................................................................................................92
3.6.3 Setting the Maximum Number of DHCP Snooping Users......................................................................93
3.6.4 (Optional) Configuring MAC Address Security on an Interface.............................................................94
3.6.5 Checking the Configuration.....................................................................................................................95
3.7 Limiting the Rate of Sending DHCP Messages...............................................................................................95
3.7.1 Establishing the Configuration Task.......................................................................................................95
3.7.2 Enabling DHCP Snooping.......................................................................................................................96
3.7.3 Setting the Maximum Rate of Sending DHCP Messages.......................................................................97
3.7.4 Checking the Configuration.....................................................................................................................98
3.8 Configuring the Packet Discarding Alarm Function........................................................................................99
3.8.1 Establishing the Configuration Task.......................................................................................................99
3.8.2 Enabling DHCP Snooping.....................................................................................................................100
3.8.3 Configuring the Packet Discarding Alarm Function.............................................................................101
3.8.4 Checking the Configuration...................................................................................................................103
3.9 Maintaining DHCP Snooping.........................................................................................................................103
3.9.1 Clearing DHCP Snooping Statistics......................................................................................................103
3.9.2 Resetting the DHCP Snooping Binding Table......................................................................................103
3.10 Configuration Examples...............................................................................................................................104
3.10.1 Example for Preventing Bogus DHCP Server Attacks.......................................................................104
3.10.2 Example for Preventing DoS Attacks by Changing the CHADDR Field...........................................107
3.10.3 Example for Preventing Attackers from Sending Bogus DHCP Messages for Extending IP Address
Leases.............................................................................................................................................................109
3.10.4 Example for Limiting the Rate of Sending DHCP Messages.............................................................112
3.10.5 Example for Applying DHCP Snooping on a Layer 2 Network.........................................................115
4 Source IP Attack Defense Configuration..............................................................................120
4.1 Overview of IP Source Guard........................................................................................................................121
4.2 IP Source Guard Features Supported by the S2700.......................................................................................121
Issue 01 (2011-07-15) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
Contents
vii