Huawei Quidway S3700 Series Configuration Manual page 137

Quidway S3700 Series Ethernet Switches
Configuration Guide - Security
Figure 3-5 Networking diagram for preventing attackers from sending bogus DHCP messages
for extending IP address leases
Configuration Roadmap
The configuration roadmap is as follows:
1.
2.
3.
4.
Data Preparation
To complete the configuration, you need the following data:
l
l
l
Procedure
Step 1 Enable DHCP snooping.
# Enable DHCP snooping globally.
Issue 01 (2011-07-15)
ISP network
L2 network
GE0/0/1
Switch
GE0/0/2
User
network
Enable DHCP snooping globally and on the interface.
Configure the interface connected to the DHCP server as the trusted interface.
Use the operation mode of the DHCP snooping binding table to check DHCP Request
messages.
Configure the alarm function for discarded packets.
ID of the VLAN that each interface belongs to
Static IP addresses from which packets are forwarded
Alarm threshold
NOTE
This configuration example provides only the commands related to the DHCP snooping configuration.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
3 DHCP Snooping Configuration
L3 network
DHCP relay
DHCP
server
124