Alcatel 9000 Betriebsanweisung PDF herunterladen (Seite 352)

Configuring DHCP Security Features Configuring DHCP Relay

page 18-16 OmniSwitch 6800/6850/9000 Network Configuration Guide June 2006

Using DHCP Snooping

Using DHCP Snooping improves network security by filtering DHCP messages received from devices

outside the network and building and maintaining a binding table (database) to track access information

for such devices.

In order to identify DHCP traffic that originates from outside the network, DHCP Snooping categorizes

ports as either trusted or untrusted. A port is trusted if it is connected to a device inside the network, such

as a DHCP server. A port is untrusted if it is connected to a device outside the network, such as a customer

switch or workstation.

Additional DHCP Snooping functionality provided includes the following:

• Traffic Suppression—Prevents the flooding of DHCP packets on the default VLAN for a DHCP

Snooping port. Note that enabling traffic suppression on a port will prevent DHCP traffic between a

DHCP server and client that belong to the same VLAN domain. See “Configuring the Port Traffic

Suppression Status” on page 18-19 for more information.

• IP Source Filtering—Restricts DHCP Snooping port traffic to only packets that contain the client

source MAC address and IP address. The DHCP Snooping binding table is used to verify the client

information for the port that is enabled for IP source filtering. See “Configuring Port IP Source Filter-

ing” on page 18-19 for more information.

• Rate Limiting—Limits the rate of DHCP packets on the port. This functionality is achieved using the

QoS application to configure ACLs for the port. See “Configuring Rate Limiting” on page 18-19 for

more information.

When DHCP Snooping is first enabled, all ports are considered untrusted. It is important to then configure

ports connected to a DHCP server inside the network as a trusted port. See “Configuring the Port Trust

Mode” on page 18-18 for more information.

If a DHCP packet is received on an untrusted port, then it is considered an untrusted packet. If a DHCP

packet is received on a trusted port, then it is considered a trusted packet. DHCP Snooping only filters

untrusted packets and will drop such packets if one or more of the following conditions are true:

• The packet received is a DHCP server packet, such as a DHCPOFFER, DHCPACK, or DHCPNAK

packet. When a server packet is received on an untrusted port, DHCP Snooping knows that it is not

from a trusted server and discards the packet.

• The source MAC address of the packet and the DHCP client hardware address contained in the packet

are not the same address.

• The packet is a DHCPRELEASE or DHCPDECLINE broadcast message that contains a source MAC

address found in the DHCP Snooping binding table, but the interface information in the binding table

does not match the interface on which the message was received.

• The packet includes a relay agent IP address that is a non-zero value.

• The packet already contains Option-82 data in the options field.

If none of the above are true, then the relay agent accepts and forwards the packet. When the relay agent

receives a DHCPACK packet from a server, the agent extracts the following information to create an entry

in the DHCP Snooping binding table:

• MAC address of the DHCP client.

• IP address for the client that was assigned by the DHCP server.

1 2 ... 347 348 349 350 351 352 353 354 355 356 357 ... 701 702

Kommentare zu diesen Handbüchern

Keine Kommentare

Alcatel 9000 Betriebsanweisung Seite 352

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Software Alcatel 9000