Understanding Dhcp Snooping For Port Security On Ex Series Switches; Dhcp Snooping Basics - Juniper JUNOS OS 10.4 - FOR EX REV 1 Manual

Related
Documentation

Understanding DHCP Snooping for Port Security on EX Series Switches

DHCP Snooping Basics

Copyright © 2010, Juniper Networks, Inc.
assigned, the attack will fail. See "Example: Configuring MAC Limiting to Protect the
Switch from DHCP Starvation Attacks" on page 3087.
Understanding DHCP Snooping for Port Security on EX Series Switches on page 3053
Understanding DAI for Port Security on EX Series Switches on page 3060
Understanding MAC Limiting and MAC Move Limiting for Port Security on EX Series
Switches on page 3062
Understanding Trusted DHCP Servers for Port Security on EX Series Switches on
page 3064
Configuring Port Security (CLI Procedure) on page 3130
Configuring Port Security (J-Web Procedure) on page 3131
DHCP snooping allows the switch to monitor and control DHCP messages received from
untrusted devices connected to the switch. When DHCP snooping is enabled, the system
snoops the DHCP messages to view DHCP lease information and build and maintain a
database of valid IP address to MAC address (IP-MAC) bindings called the DHCP snooping
database. Only clients with valid bindings are allowed access to the network.
DHCP Snooping Basics on page 3053
DHCP Snooping Process on page 3054
DHCP Server Access on page 3055
DHCP Snooping Table on page 3058
Static IP Address Additions to the DHCP Snooping Database on page 3058
Snooping DHCP Packets That Have Invalid IP Addresses on page 3058
Dynamic Host Configuration Protocol (DHCP) allocates IP addresses dynamically,
"leasing" addresses to devices so that the addresses can be reused when no longer
needed. Hosts and end devices that require IP addresses obtained through DHCP must
communicate with a DHCP server across the LAN.
DHCP snooping acts as a guardian of network security by keeping track of valid IP
addresses assigned to downstream network devices by a trusted DHCP server (the server
is connected to a trusted network port). By default, all trunk ports on the switch are
trusted and all access ports are untrusted for DHCP snooping. You can modify these
defaults on each of the switch's interfaces.
When DHCP snooping is enabled, the lease information from the switch (which is a DHCP
client) is used to create the DHCP snooping database, a mapping of IP address to
VLAN–MAC-address pairs. For each VLAN–MAC-address pair, the database stores the
corresponding IP address.
Chapter 99: Port Security Overview
3053