From Rogue Dhcp Server Attacks - Juniper JUNOS OS 10.4 - FOR EX REV 1 Manual

Complete Software Guide for Junos
Related
Documentation
Example: Configuring MAC Limiting, Including Dynamic and Allowed MAC Addresses,
to Protect the Switch from Ethernet Switching Table Overflow Attacks
Requirements
3080
®
OS for EX Series Ethernet Switches, Release 10.4
Example: Configuring DHCP Snooping, DAI , and MAC Limiting on an EX Series Switch
with Access to a DHCP Server Through a Second Switch on page 3097
Example: Configuring a DHCP Server Interface as Untrusted to Protect the Switch from
Rogue DHCP Server Attacks on page 3083
Example: Configuring Allowed MAC Addresses to Protect the Switch from DHCP
Snooping Database Alteration Attacks on page 3094
Example: Configuring DHCP Snooping and DAI to Protect the Switch from ARP Spoofing
Attacks on page 3090
Example: Configuring MAC Limiting, Including Dynamic and Allowed MAC Addresses,
to Protect the Switch from Ethernet Switching Table Overflow Attacks on page 3080
Example: Configuring MAC Limiting to Protect the Switch from DHCP Starvation Attacks
on page 3087
Configuring Port Security (CLI Procedure) on page 3130
Configuring Port Security (J-Web Procedure) on page 3131
In an Ethernet switching table overflow attack, an intruder sends so many requests from
new MAC addresses that the Ethernet switching table fills up and then overflows, forcing
the switch to broadcast all messages.
This example describes how to configure MAC limiting and allowed MAC addresses, two
port security features, to protect the switch from Ethernet switching table attacks:
Requirements on page 3080
Overview and Topology on page 3081
Configuration on page 3082
Verification on page 3083
This example uses the following hardware and software components:
One EX Series switch
Junos OS Release 9.0 or later for EX Series switches
A DHCP server to provide IP addresses to network devices on the switch
Before you configure specific port security features to mitigate common access-interface
attacks, be sure you have:
Connected the DHCP server to the switch.
Configured the VLAN employee-vlan
with Multiple VLANs for EX Series Switches" on page 1532.
on the switch. See "Example: Setting Up Bridging
Copyright © 2010, Juniper Networks, Inc.