Understanding Dhcp Snooping For Port Security On Ex Series Switches; Dhcp Snooping Basics - Juniper JUNOS OS 10.3 - SOFTWARE Manual

Related
Documentation

Understanding DHCP Snooping for Port Security on EX Series Switches

DHCP Snooping Basics

Copyright © 2010, Juniper Networks, Inc.
assigned, the attack will fail. See "Example: Configuring MAC Limiting to Protect the
Switch from DHCP Starvation Attacks" on page 2863.
Understanding DHCP Snooping for Port Security on EX Series Switches on page 2829
Understanding DAI for Port Security on EX Series Switches on page 2836
Understanding MAC Limiting and MAC Move Limiting for Port Security on EX Series
Switches on page 2838
Understanding Trusted DHCP Servers for Port Security on EX Series Switches on
page 2840
Configuring Port Security (CLI Procedure) on page 2906
Configuring Port Security (J-Web Procedure) on page 2907
DHCP snooping allows the switch to monitor and control DHCP messages received from
untrusted devices connected to the switch. When DHCP snooping is enabled, the system
snoops the DHCP messages to view DHCP lease information and build and maintain a
database of valid IP address to MAC address (IP-MAC) bindings called the DHCP snooping
database. Only clients with valid bindings are allowed access to the network.
DHCP Snooping Basics on page 2829
DHCP Snooping Process on page 2830
DHCP Server Access on page 2831
DHCP Snooping Table on page 2834
Static IP Address Additions to the DHCP Snooping Database on page 2834
Snooping DHCP Packets That Have Invalid IP Addresses on page 2834
Dynamic Host Configuration Protocol (DHCP) allocates IP addresses dynamically,
"leasing" addresses to devices so that the addresses can be reused when no longer
needed. Hosts and end devices that require IP addresses obtained through DHCP must
communicate with a DHCP server across the LAN.
DHCP snooping acts as a guardian of network security by keeping track of valid IP
addresses assigned to downstream network devices by a trusted DHCP server (the server
is connected to a trusted network port). By default, all trunk ports on the switch are
trusted and all access ports are untrusted for DHCP snooping. You can modify these
defaults on each of the switch's interfaces.
When DHCP snooping is enabled, the lease information from the switch (which is a DHCP
client) is used to create the DHCP snooping database, a mapping of IP address to
VLAN–MAC-address pairs. For each VLAN–MAC-address pair, the database stores the
corresponding IP address.
Chapter 93: Port Security Overview
2829