Table of Contents
Advertisement
Limit the number of ARP entries that a Layer 3 interface can learn.
Set the MAC learning limit for a Layer 2 port, and disable unknown frame forwarding when
the MAC learning limit is reached.
•
To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same
source MAC address, you can enable MAC address check on the DHCP relay agent. The
DHCP relay agent compares the chaddr field of a received DHCP request with the source MAC
address in the frame header. If they are the same, the DHCP relay agent forwards the request
to the DHCP server. If not, the relay agent discards the request.
Enable MAC address check only on the DHCP relay agent directly connected to the DHCP clients. A
DHCP relay agent changes the source MAC address of DHCP packets before sending them.
A MAC address check entry has an aging time. When the aging time expires, both of the following
occur:
•
The entry ages out.
•
The DHCP relay agent rechecks the validity of DHCP requests sent from the MAC address in
the entry.
To enable MAC address check:
Step
1.
Enter system view.
2.
Set the aging time for MAC
address check entries.
3.
Enter the interface view.
4.
Enable MAC address check.
Enabling DHCP server proxy on the DHCP relay agent
The DHCP server proxy feature isolates DHCP servers from DHCP clients and protects DHCP
servers against attacks.
Upon receiving a response from the server, the DHCP server proxy modifies the server's IP address
as the relay interface's IP address before sending out the response. The DHCP client takes the
DHCP relay agent as the DHCP server.
To configure DHCP server proxy on the DHCP relay agent:
Step
1.
Enter system view.
2.
Enter interface view.
3.
Enable DHCP relay agent and
DHCP server proxy on the
interface.
Command
system-view
dhcp relay check mac-address
aging-time time
interface interface-type
interface-number
dhcp relay check mac-address
Command
system-view
interface interface-type
interface-number
dhcp select relay proxy
140
Remarks
N/A
The default aging time is 30
seconds.
This command takes effect
only after you execute the
dhcp relay check
mac-address command.
N/A
By default, MAC address
check is disabled.
Remarks
N/A
N/A
By default, the interface
operates in DHCP server mode.
Advertisement
Table of Contents
Troubleshooting
