LevelOne GEL-2670 User Manual page 113

Network traffic may be disrupted when malicious DHCP messages are
◆
received from an outside source. DHCP snooping is used to filter DHCP
messages received on a non-secure interface from outside the network
or fire wall. When DHCP snooping is enabled globally and enabled on a
VLAN interface, DHCP messages received on an untrusted interface
from a device not listed in the DHCP snooping table will be dropped.
Table entries are only learned for trusted interfaces. An entry is added
◆
or removed dynamically to the DHCP snooping table when a client
receives or releases an IP address from a DHCP server. Each entry
includes a MAC address, IP address, lease time, VLAN identifier, and
port identifier.
When DHCP snooping is enabled, DHCP messages entering an
◆
untrusted interface are filtered based upon dynamic entries learned via
DHCP snooping.
Filtering rules are implemented as follows:
◆
If the global DHCP snooping is disabled, all DHCP packets are
■
forwarded.
If DHCP snooping is enabled globally, all DHCP packets are
■
forwarded for a trusted port. If the received packet is a DHCP ACK
message, a dynamic DHCP snooping entry is also added to the
binding table.
If DHCP snooping is enabled globally, but the port is not trusted, it
■
is processed as follows:
If the DHCP packet is a reply packet from a DHCP server
■
(including OFFER, ACK or NAK messages), the packet is
dropped.
If a DHCP DECLINE or RELEASE message is received from a
■
client, the switch forwards the packet only if the corresponding
entry is found in the binding table.
If a DHCP DISCOVER, REQUEST or INFORM message is received
■
from a client, the packet is forwarded.
If the DHCP packet is not a recognizable type, it is dropped.
■
If a DHCP packet from a client passes the filtering criteria above, it
■
will only be forwarded to trusted ports in the same VLAN.
If a DHCP packet is from server is received on a trusted port, it will
■
be forwarded to both trusted and untrusted ports in the same VLAN.
If the DHCP snooping is globally disabled, all dynamic bindings are
■
removed from the binding table.
Additional considerations when the switch itself is a DHCP client –
■
The port(s) through which the switch submits a client request to the
DHCP server must be configured as trusted. Note that the switch
will not add a dynamic entry for itself to the binding table when it
– 113 –
| Configuring the Switch
C 4
HAPTER
Configuring Security