From Rogue Dhcp Server Attacks - Juniper JUNOS OS 10.3 - SOFTWARE Manual

Complete Software Guide for Junos
Related
Documentation
Example: Configuring MAC Limiting, Including Dynamic and Allowed MAC Addresses,
to Protect the Switch from Ethernet Switching Table Overflow Attacks
Requirements
2856
®
OS for EX Series Ethernet Switches, Release 10.3
Example: Configuring DHCP Snooping, DAI , and MAC Limiting on an EX Series Switch
with Access to a DHCP Server Through a Second Switch on page 2873
Example: Configuring a DHCP Server Interface as Untrusted to Protect the Switch from
Rogue DHCP Server Attacks on page 2859
Example: Configuring Allowed MAC Addresses to Protect the Switch from DHCP
Snooping Database Alteration Attacks on page 2870
Example: Configuring DHCP Snooping and DAI to Protect the Switch from ARP Spoofing
Attacks on page 2866
Example: Configuring MAC Limiting, Including Dynamic and Allowed MAC Addresses,
to Protect the Switch from Ethernet Switching Table Overflow Attacks on page 2856
Example: Configuring MAC Limiting to Protect the Switch from DHCP Starvation Attacks
on page 2863
Configuring Port Security (CLI Procedure) on page 2906
Configuring Port Security (J-Web Procedure) on page 2907
In an Ethernet switching table overflow attack, an intruder sends so many requests from
new MAC addresses that the Ethernet switching table fills up and then overflows, forcing
the switch to broadcast all messages.
This example describes how to configure MAC limiting and allowed MAC addresses, two
port security features, to protect the switch from Ethernet switching table attacks:
Requirements on page 2856
Overview and Topology on page 2857
Configuration on page 2858
Verification on page 2859
This example uses the following hardware and software components:
One EX Series switch
Junos OS Release 9.0 or later for EX Series switches
A DHCP server to provide IP addresses to network devices on the switch
Before you configure specific port security features to mitigate common access-interface
attacks, be sure you have:
Connected the DHCP server to the switch.
Configured the VLAN employee-vlan
with Multiple VLANs for EX Series Switches" on page 1312.
on the switch. See "Example: Setting Up Bridging
Copyright © 2010, Juniper Networks, Inc.