Juniper JUNOS OS 10.3 - SOFTWARE Manual page 2959

Example: Configuring MAC Limiting to Protect the Switch from DHCP Starvation
Attacks
Requirements
Overview and Topology
Copyright © 2010, Juniper Networks, Inc.
In a DHCP starvation attack, an attacker floods an Ethernet LAN with DHCP requests
from spoofed (counterfeit) MAC addresses. The switch's trusted DHCP server or servers
cannot keep up with the requests and can no longer assign IP addresses and lease times
to legitimate DHCP clients on the switch. Requests from those clients are either dropped
or directed to a rogue DHCP server set up by the attacker.
This example describes how to configure MAC limiting, a port security feature, to protect
the switch against DHCP starvation attacks:
Requirements on page 2863
Overview and Topology on page 2863
Configuration on page 2864
Verification on page 2865
This example uses the following hardware and software components:
One EX Series switch
Junos OS Release 9.0 or later for EX Series switches
A DHCP server to provide IP addresses to network devices on the switch
Before you configure MAC limiting, a port security feature, to mitigate DHCP starvation
attacks, be sure you have:
Connected the DHCP server to the switch.
Configured the VLAN
employee-vlan
with Multiple VLANs for EX Series Switches" on page 1312.
Ethernet LANs are vulnerable to address spoofing and DoS attacks on network devices.
This example describes how to protect the switch against one common type of attack,
a DHCP starvation attack.
This example shows how to configure port security features on an EX3200-24P switch
that is connected to a DHCP server.
The setup for this example includes the VLAN
for creating that VLAN is described in the topic "Example: Setting Up Bridging with Multiple
VLANs for EX Series Switches" on page 1312. That procedure is not repeated here. Figure
71 on page 2864 illustrates the topology for this example.
Chapter 94: Examples: Port Security Configuration
on the switch. See "Example: Setting Up Bridging
employee-vlan on the switch. The procedure
2863