Enabling Dhcp-Request Message Attack Protection; Configuring Dhcp Packet Rate Limit - HP A7500 Series Configuration Manual

To do...
Enter interface view
Enable MAC address check
NOTE:
You can enable MAC address check only on Layer 2 Ethernet ports and Layer 2 aggregate interfaces.
Enabling DHCP-REQUEST message attack
protection
Attackers may forge DHCP-REQUEST messages to renew the IP address leases for legitimate DHCP
clients that no longer need the IP addresses. These forged messages keep a victim DHCP server renewing
the leases of IP addresses instead of releasing the IP addresses. This wastes IP address resources.
To prevent such attacks, you can enable DHCP-REQUEST message check on DHCP snooping devices.
With this feature enabled, upon receiving a DHCP-REQUEST message, a DHCP snooping device looks
up local DHCP snooping entries for the corresponding entry of the message. If an entry is found, the
DHCP snooping device compares the entry with the message information. If they are consistent, the
DHCP-REQUEST message is considered a valid lease renewal request and forwarded to the DHCP server.
If they are not consistent, the message is considered a forged lease renewal request and discarded. If no
corresponding entry is found, the message is considered valid and forwarded to the DHCP server.
Follow these steps to enable DHCP-REQUEST message check:
To do...
Enter system view
Enter interface view
Enable DHCP-REQUEST
message check
NOTE:
You can enable DHCP-REQUEST message check only on Layer 2 Ethernet ports, and Layer 2 aggregate
interfaces.

Configuring DHCP packet rate limit

Configuration guidelines
You can configure DHCP packet rate limit only on Layer 2 Ethernet ports and Layer 2 aggregate
•
interfaces.
• If a Layer 2 Ethernet port belongs to an aggregation group, it uses the DHCP packet maximum rate
configured on the corresponding Layer 2 aggregate interface.
Use the command...
interface interface-type
interface-number
dhcp-snooping check mac-address
Use the command...
system-view
interface interface-type
interface-number
dhcp-snooping check
request-message
77
Remarks
—
Required
Disabled by default.
Remarks
—
—
Required
Disabled by default.