Table of Contents
Advertisement
Step
2.
Disable the DHCP
server from
encapsulating
Option 60 in DHCP
replies.
Configuring the DHCP server security features
Restrictions and guidelines
The DHCP server security features are not applicable if a DHCP relay agent exists in the network.
This is because the MAC address of the DHCP relay agent is encapsulated as the source MAC
address in the DHCP request received by the DHCP server. In this case, you must configure the
DHCP relay agent security features. For more information, see
security
features."
If you execute both the dhcp flood-protection enable and dhcp server check mac-address
commands on an interface, the dhcp server check mac-address command takes effect.
Configuring DHCP flood attack protection
About DHCP flood attack protection
The DHCP flood attack protection enables the DHCP server to detect DHCP flood attacks according
to the DHCP packet rate threshold on a per-MAC basis.
When the DHCP server receives a DHCP packet from a client (MAC address), it creates a DHCP
flood attack entry in check state. If the number of DHCP packets from the same MAC address
reaches the upper limit in the detection duration, the server determines that the client is launching a
DHCP flood attack. The DHCP flood attack entry changes to the restrain state, and the DHCP server
discards the DHCP packets from that client. When the aging time of the entry is reached, the DHCP
server deletes the entry. If a DHCP packet from the MAC address arrives later, the DHCP server will
create a flood attack entry and count the number of incoming DHCP packets for that client again.
Procedure
To configure DHCP flood attack protection:
Step
1.
Enter system view.
2.
(Optional) Set the DHCP
packet rate threshold for
DHCP flood attack detection.
3.
(Optional) Set the DHCP
flood attack entry aging time.
4.
Enter interface view.
5.
Enable DHCP flood attack
protection.
Command
dhcp server reply-exclude-option60
Command
system-view
dhcp flood-protection
threshold packet-number
milliseconds
dhcp flood-protection
aging-time time
interface interface-type
interface-number
dhcp flood-protection enable
112
Remarks
By default, the DHCP server can
encapsulate Option 60 in DHCP
replies.
"Configuring the DHCP relay agent
Remarks
N/A
By default, the device allows a
maximum of 6 DHCP packets per
5000 milliseconds from each
DHCP client.
The default setting is 300
seconds.
N/A
By default, DHCP flood attack
protection is disabled.
Advertisement
Table of Contents
Troubleshooting
