Protection Against Ip Source Address Spoofing; Prerequisite: Dhcp Snooping - HP ProCurve 6120G/XG Manual

Configuring Advanced Threat Protection
Dynamic IP Lockdown

Protection Against IP Source Address Spoofing

Many network attacks occur when an attacker injects packets with forged IP
source addresses into the network. Also, some network services use the IP
source address as a component in their authentication schemes. For example,
the BSD "r" protocols (rlogin, rcp, rsh) rely on the IP source address for packet
authentication. SNMPv1 and SNMPv2c also frequently use authorized IP
address lists to limit management access. An attacker that is able to send
traffic that appears to originate from an authorized IP source address may gain
access to network services for which he is not authorized.
Dynamic IP lockdown provides protection against IP source address spoofing
by means of IP-level port security. IP packets received on a port enabled for
dynamic IP lockdown are only forwarded if they contain a known IP source
address and MAC address binding for the port.
Dynamic IP lockdown uses information collected in the DHCP Snooping lease
database and through statically configured IP source bindings to create inter­
nal, per-port lists. The internal lists are dynamically created from known IP­
to-MAC address bindings to filter VLAN traffic on both the source IP address
and source MAC address.

Prerequisite: DHCP Snooping

Dynamic IP lockdown requires that you enable DHCP snooping as a
prerequisite for its operation on ports and VLAN traffic:
■
■
10-24
Dynamic IP lockdown only enables traffic for clients whose leased IP
addresses are already stored in the lease database created by DHCP
snooping or added through a static configuration of an IP-to-MAC binding.
Therefore, if you enable DHCP snooping after dynamic IP lockdown is
enabled, clients with an existing DHCP-assigned address must either
request a new leased IP address or renew their existing DHCP-assigned
address. Otherwise, a client's leased IP address is not contained in the
DHCP binding database. As a result, dynamic IP lockdown will not allow
inbound traffic from the client.
It is recommended that you enable DHCP snooping a week before you
enable dynamic IP lockdown to allow the DHCP binding database to learn
clients' leased IP addresses. You must also ensure that the lease time for
the information in the DHCP binding database lasts more than a week.
Alternatively, you can configure a DHCP server to re-allocate IP addresses
to DHCP clients. In this way, you repopulate the lease database with
current IP-to-MAC bindings.