Preventing The Bogus Dhcp Server Attack; Establishing The Configuration Task - Huawei Quidway S9300 Configuration Manual

2 DHCP Snooping Configuration
Type of Attacks Defended Against by DHCP Snooping
DHCP snooping provides different operation modes according to the type of attacks, as shown
in Table
Table 2-1 Matching table between type of attacks and DHCP snooping operation modes
Type of Attacks
Bogus DHCP server attack
DoS attack by changing the value of the
CHADDR field
Attack by sending bogus messages to
extend IP address leases
DHCP flooding attack

2.3 Preventing the Bogus DHCP Server Attack

This section describes how to prevent the attackers from attacking the DHCP server through the
S9300 by forging the DHCP server.

2.3.1 Establishing the Configuration Task

2.3.2 Enabling DHCP Snooping
2.3.3 Configuring an Interface as a Trusted Interface
2.3.4 (Optional) Enabling Detection of Bogus DHCP Servers
2.3.5 Checking the Configuration
2.3.1 Establishing the Configuration Task
Applicable Environment
When a bogus DHCP server exists on a network, the bogus DHCP server on the network replies
with incorrect messages such as the incorrect IP address of the gateway, incorrect domain name
server (DNS) server, and incorrect IP address to the DHCP client. As a result, the DHCP client
cannot access the network or cannot access the correct destination network.
2-4
NOTE
When the S9300 is deployed on a Layer 2 network or functions as the DHCP relay agent, DHCP snooping
is enabled. In this manner, the S9300 can defend against attacks shown in
The difference is that: when the S9300 functions as the DHCP relay agent, it supports the association
function between ARP and DHCP snooping. The S9300, however, does not support the association function
when it is deployed on a Layer 2 network.
2-1.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
Quidway S9300 Terabit Routing Switch
Configuration Guide - Security
Table
DHCP Snooping Operation Mode
Setting an interface to trusted or untrusted
Checking the CHADDR field in DHCP
messages
Checking whether DHCP request messages
match entries in the DHCP snooping binding
table
Limiting the rate of sending DHCP messages
2-1.
Issue 01 (2009-07-28)