Configuring The Dhcp Relay Agent Security Functions; Configuring Address Check; Configuring Periodic Refresh Of Dynamic Client Entries - HP 10500 Series Configuration Manual

Configuring the DHCP relay agent security
functions

Configuring address check

Address check can block illegal hosts from accessing external networks.
With this feature enabled, the DHCP relay agent can dynamically record clients' IP-to-MAC bindings
after they obtain IP addresses through DHCP. You can also configure static IP-to-MAC bindings on the
DHCP relay agent so that users can access external networks by using fixed IP addresses.
Upon receiving a packet from a host, the DHCP relay agent checks the source IP and MAC addresses in
the packet against the recorded dynamic and static bindings. If no match is found, the DHCP relay agent
does not learn the ARP entry of the host, and does not forward any reply to the host, which therefore
cannot access external networks through the DHCP relay agent.
Configuration guidelines
Follow these guidelines when you configure address check:
The dhcp relay address-check enable command can only be executed on Layer 3 Ethernet
•
interfaces (including subinterfaces) and VLAN interfaces.
• Before enabling address check on an interface, enable the DHCP service, and enable the DHCP
relay agent on the interface.
The dhcp relay address-check enable command only checks IP and MAC addresses. It does not
•
check interfaces.
When using the dhcp relay security static command to bind an interface to a static binding entry,
•
make sure the interface is configured as a DHCP relay agent. If you do not, address entry conflicts
may occur.
Configuration procedure
To create a static binding and enable address check:
Step
1. Enter system view.
2. Create a static binding.
3. Enter interface view.
4. Enable address check.

Configuring periodic refresh of dynamic client entries

A DHCP client unicasts a DHCP-RELEASE message to the DHCP server to release its IP address. The
DHCP relay agent simply conveys the message to the DHCP server and does not remove the IP-to-MAC
entry of the client.
Command
system-view
dhcp relay security static ip-address
mac-address [ interface
interface-type interface-number ]
interface interface-type
interface-number
dhcp relay address-check enable
60
Remarks
N/A
Optional.
No static binding is created by
default.
N/A
Disabled by default.