Establishing The Configuration Task - Huawei Quidway S9300 Configuration Manual

Quidway S9300 Terabit Routing Switch
Configuration Guide - Security
2.5.4 Enabling the Checking of DHCP Request Messages
2.5.5 (Optional) Configuring the Option 82 Function
2.5.6 Checking the Configuration

2.5.1 Establishing the Configuration Task

Applicable Environment
The attacker pretends to be a valid user and continuously sends DHCP Request messages
intending to extend the IP address lease. As a result, certain expired IP addresses cannot be
reused.
To prevent the attacker from sending bogus DHCP messages to extend IP address leases, you
can create the DHCP snooping binding table on the S9300 to check DHCP Request messages.
If the source IP address, source MAC address, VLAN, and interface of the DHCP Request
messages match entries in the binding table, the DHCP Request messages are then forwarded.
Otherwise, the DHCP Request messages are discarded.
The S9300 checks DHCP Request messages as follows:
l
l
Pre-configuration Tasks
Before preventing the attacker from sending bogus DHCP messages for extending IP address
leases, complete the following tasks:
l
l
Data Preparation
To prevent the attacker from sending bogus DHCP messages for extending IP address leases,
you need the following data.
No.
1
2
Issue 01 (2009-07-28)
The S9300 checks whether the VLAN and CIADDR field of the DHCP Request messages
match the VLAN and IP address of entries in the binding table. If they do not match, the
S9300 considers that the user logs in for the first time and allows the DHCP Request
messages to pass through.
If they match, it indicates that the user has logged in before and the DHCP Request messages
may be bogus messages used to extend IP address leases. The S9300 then checks whether
the CIADDR field and interface of the DHCP Request messages match the MAC address
and interface of entries in the binding table. If yes, the S9300 forwards the DHCP Request
messages. Otherwise, the S9300 discards the DHCP Request messages.
Configuring the DHCP server
Configuring the DHCP relay agent
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
2 DHCP Snooping Configuration
Data
Type and number of the interface enabled
with detection of bogus DHCP servers
Static IP addresses from which packets are
forwarded
2-11